Use after free in DOM in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to...
CVE-2026-91736
Use after free in DOM in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside
#severity:high
共收录 5373 条相关情报。
← 返回所有主题Improper state validation in Skia in Google Chrome prior to 153.0.8010.47 allowed a remote...
CVE-2026-91733
Improper state validation in Skia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised
Incorrect authorization in Core in Google Chrome on on Windows prior to 153.0.8010.47 allowed a...
CVE-2026-91734
Incorrect authorization in Core in Google Chrome on on Windows prior to 153.0.8010.47 allowed a local attacker to execut
Race condition in Extensions in Google Chrome on on Mac prior to 153.0.8010.47 allowed a remote...
CVE-2026-91748
Race condition in Extensions in Google Chrome on on Mac prior to 153.0.8010.47 allowed a remote attacker who had comprom
Type confusion in Compositing in Google Chrome prior to 153.0.8010.47 allowed a remote attacker...
CVE-2026-91731
Type confusion in Compositing in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary cod
adm-zip versions 0.5.14 through 0.6.0 fail to apply zlib decompression output limits when ZIP...
CVE-2026-92000
adm-zip versions 0.5.14 through 0.6.0 fail to apply zlib decompression output limits when ZIP entries declare zero uncom
Incorrect authorization in WebUI in Google Chrome prior to 153.0.8010.47 allowed a remote...
CVE-2026-91735
Incorrect authorization in WebUI in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised t
Type confusion in CacheStorage in Google Chrome prior to 153.0.8010.47 allowed a remote attacker...
CVE-2026-91741
Type confusion in CacheStorage in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary co
Race condition in Core in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had...
CVE-2026-91743
Race condition in Core in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the rendere
Use after free in Input in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had...
CVE-2026-91724
Use after free in Input in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the render
Incorrect reference resolution in Extensions in Google Chrome on on Mac prior to 153.0.8010.47...
CVE-2026-91727
Incorrect reference resolution in Extensions in Google Chrome on on Mac prior to 153.0.8010.47 allowed a local attacker
Use after free in Internals in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to...
CVE-2026-91721
Use after free in Internals in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to potentially execute arb
@zereight/mcp-gitlab has multiple safety-control bypasses: execute_graphql read-only + allow-list bypass, unauthenticated transports, session-exhaustion DoS
### Summary @zereight/mcp-gitlab exposes GitLab to an LLM agent while relying on read-only mode, a project allow-list, a
emp3r0r has an unauthenticated HTTP Polling DoS
CVE-2026-61554
### Summary The `http_poll` C2 transport accepts attacker-controlled HTTP polling sessions before CBOR `MsgAuth` authent
Http4s: Ember HTTP/2 buffers a frame's declared payload before checking SETTINGS_MAX_FRAME_SIZE
CVE-2026-88975
### Summary An unauthenticated peer can make Ember's HTTP/2 read loop hold 16 MiB of a single frame in memory on a conne
libp2p-quic: Remote panic via certificate expiry race during QUIC handshake
CVE-2026-61544
### Summary `libp2p-quic` can panic on an inbound QUIC handshake if a malicious peer presents a valid, short lived libp
Http4s Ember HTTP/2: unbounded continuation frame accumulation
CVE-2026-69218
When Ember receives an HTTP/2 `HEADERS` or `PUSH_PROMISE` frame without the `END_HEADERS` flag, it buffers the header bl
Http4s Ember HTTP/2 has an unbounded outbound frame queue
CVE-2026-69213
Ember's HTTP/2 connection serializes all outgoing frames through a single unbounded queue drained by one writer fiber (`
Http4s: DigestAuth nonce map grows unbounded
CVE-2026-69208
The `DigestAuth` server middleware's stale-nonce cleanup uses an inverted comparison: it removes *fresh* nonces and stop
Http4s Ember Transfer-Encoding value parsing (TE.CL / TE.0 request smuggling)
CVE-2026-69205
## Summary Ember's HTTP/1.1 header parser matches the `Transfer-Encoding` header value with a case-sensitive substring