Improper Input validation in the AMD Secure Processor (ASP) PCI driver may allow a local attacker...
CVE-2025-0045
Improper Input validation in the AMD Secure Processor (ASP) PCI driver may allow a local attacker to create a buffer ove
2026-05-15 归档
今日共收录 1277 条安全情报，包含 487 个 CVE，424 篇安全通告，以及 55 篇研究论文。
← 返回归档列表Inappropriate implementation in Media in Google Chrome on iOS prior to 148.0.7778.168 allowed a...
CVE-2026-8585
Inappropriate implementation in Media in Google Chrome on iOS prior to 148.0.7778.168 allowed a remote attacker who had
Insufficient policy enforcement in WebXR in Google Chrome on Android prior to 148.0.7778.168...
CVE-2026-8583
Insufficient policy enforcement in WebXR in Google Chrome on Android prior to 148.0.7778.168 allowed a remote attacker w
Inappropriate implementation in Views in Google Chrome on iOS prior to 148.0.7778.168 allowed a...
CVE-2026-8584
Inappropriate implementation in Views in Google Chrome on iOS prior to 148.0.7778.168 allowed a remote attacker who had
Incorrect security UI in Downloads in Google Chrome on Android and Mac prior to 148.0.7778.168...
CVE-2026-8564
Incorrect security UI in Downloads in Google Chrome on Android and Mac prior to 148.0.7778.168 allowed a remote attacker
Use after free in Mojo in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to...
CVE-2026-8580
Use after free in Mojo in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandb
Insufficient policy enforcement in Payments in Google Chrome on Android prior to 148.0.7778.168...
CVE-2026-8566
Insufficient policy enforcement in Payments in Google Chrome on Android prior to 148.0.7778.168 allowed a remote attacke
Insufficient policy enforcement in GPU in Google Chrome on Android prior to 148.0.7778.168...
CVE-2026-8571
Insufficient policy enforcement in GPU in Google Chrome on Android prior to 148.0.7778.168 allowed a remote attacker who
Heap buffer overflow in GPU in Google Chrome on Android prior to 148.0.7778.168 allowed a remote...
CVE-2026-8552
Heap buffer overflow in GPU in Google Chrome on Android prior to 148.0.7778.168 allowed a remote attacker to perform an
Heap buffer overflow in SwiftShader in Google Chrome on Mac and iOS prior to 148.0.7778.168...
CVE-2026-8560
Heap buffer overflow in SwiftShader in Google Chrome on Mac and iOS prior to 148.0.7778.168 allowed a remote attacker to
Insufficient policy enforcement in Network in Google Chrome on Android prior to 148.0.7778.168...
CVE-2026-8572
Insufficient policy enforcement in Network in Google Chrome on Android prior to 148.0.7778.168 allowed a remote attacker
Script injection in SanitizerAPI in Google Chrome on Android prior to 148.0.7778.168 allowed a...
CVE-2026-8539
Script injection in SanitizerAPI in Google Chrome on Android prior to 148.0.7778.168 allowed a remote attacker to inject
vm2 Has a Sandbox Breakout Using Async Generator
CVE-2026-45411
### Summary VM2 suffers from a sandbox breakout vulnerability. This allows attackers to write code which can escape fro
python-utcp: Full Process Environment Exposed to CLI Subprocess - Secrets Leakage via Command Injection
CVE-2026-45370
## Summary `_prepare_environment()` in `cli_communication_protocol.py` passes a full copy of `os.environ` to every CLI
utcp-cli Vulnerable to Command Injection via Unsanitized Argument Substitution in CLI Communication Protocol
CVE-2026-45369
## Summary The `_substitute_utcp_args` method in `cli_communication_protocol.py` inserts user-controlled `tool_args` va
@utcp/http: SSRF via attacker-controlled OpenAPI servers[0].url in HTTP communication protocol
CVE-2026-45366
## Summary The `@utcp/http` package is vulnerable to a blind Server-Side Request Forgery (SSRF) caused by a trust-bound
Marten has an injection vulnerability in its full-text search regConfig parameter
CVE-2026-45288
## Summary Marten's full-text search APIs interpolated the user-supplied `regConfig` parameter directly into the genera
DeepSeek TUI: task_create Insecure Defaults Enable RCE via Prompt Injection in Project Files
CVE-2026-45374
### Summary The `task_create` tool spawns durable sub-agents that inherit two insecure defaults: - `allow_shell` defau
DeepSeek TUI has SSRF via HTTP Redirect Bypass in fetch_url Tool
CVE-2026-45310
### Summary The `fetch_url` tool validates the initial URL's resolved IP address against a restricted-IP blocklist (`is_
Open WebUI has an Indirect Object Reference (IDOR) in user notes
CVE-2026-45666
### Summary The API /api/v1/notes/{note_id} endpoint lacks proper authorization checks, allowing authenticated users to