Use after free in Media in Google Chrome on Windows prior to 151.0.7922.109 allowed a remote...
CVE-2026-19163
Use after free in Media in Google Chrome on Windows prior to 151.0.7922.109 allowed a remote attacker who had compromise
#advisory
共收录 23530 条相关情报。
← 返回所有主题Insufficient policy enforcement in Navigation in Google Chrome prior to 151.0.7922.109 allowed a...
CVE-2026-19152
Insufficient policy enforcement in Navigation in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had
Use after free in Views in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who...
CVE-2026-19159
Use after free in Views in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who convinced a user to engag
Use after free in Translate in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to...
CVE-2026-19145
Use after free in Translate in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to execute arbitrary code
Inappropriate implementation in V8 in Google Chrome prior to 151.0.7922.109 allowed a remote...
CVE-2026-19168
Inappropriate implementation in V8 in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to execute arbitra
Use after free in Views in Google Chrome on Windows prior to 151.0.7922.109 allowed a remote...
CVE-2026-19158
Use after free in Views in Google Chrome on Windows prior to 151.0.7922.109 allowed a remote attacker who convinced a us
Heap buffer overflow in Base in Google Chrome prior to 151.0.7922.109 allowed an attacker who...
CVE-2026-19156
Heap buffer overflow in Base in Google Chrome prior to 151.0.7922.109 allowed an attacker who convinced a user to instal
Use after free in HTML in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to...
CVE-2026-19144
Use after free in HTML in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to potentially exploit heap co
Use after free in Extensions in Google Chrome prior to 151.0.7922.109 allowed an attacker who...
CVE-2026-19165
Use after free in Extensions in Google Chrome prior to 151.0.7922.109 allowed an attacker who convinced a user to instal
Craft CMS: Arbitrary file read via SplFileObject in non-sandboxed template contexts
The `create()` Twig function (introduced in 5.9.0) allows instantiation of arbitrary PHP classes from template code, res
h2: Duplicate Host header could facilitate request smuggling
CVE-2026-71554
### Impact h2 <=4.4.0 accepts request header blocks containing more than one Host header, and forwards every Host header
Craft CMS: Authenticated leak of secret environment variables
Environment variables and secrets are interpolated into a Twig template even when the Twig sandbox is enabled, allowing
PILOS: Reverse tabnabbing in room description
CVE-2026-71555
PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton. From 2.1.0 until 4.14.1, PILOS do
Craft CMS: Missing authorization check allows non-admin control panel users access to user registration metrics
`ChartsController::actionGetNewUsersData()` at `/actions/charts/get-new-users-data` is missing a `requirePermission('vie
OpenZeppelin Contracts Wizard has Code Injection in Generated Hardhat and Foundry Tests via Unsanitized opts.name / opts.uri
CVE-2026-48054
OpenZeppelin Contracts Wizardis a web application to interactively build a contract out of components from OpenZeppelin
Frappe: Stored XSS in Column Headers via Data Import
CVE-2026-49391
Frappe is a full-stack web application framework. Prior to 16.19.0 and 15.109.0, Data Import does not escape imported co
Craft CMS: Incorrect path validation could potentially lead to path traversal
The `ensurePathIsContained` function of the `Local` file system class is theoretically vulnerable to path traversal, alt
Craft CMS: Stored XSS in the control panel via unescaped draft name
The control-panel helper that renders element chip/card labels writes an element's `draftName` into the page without HTM
OpenReception: WebAuthn passkey injection allows account takeover
CVE-2026-48087
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to ver
Flowise 3.1.4 Authentication Bypass via OAuth2 Credential Refresh Endpoint
CVE-2026-70636
Flowise through 3.1.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to access th