Export limit exceeded: 27934 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (27934 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-87553 | 1 Google | 1 Chrome | 2026-09-09 | 8.3 High |
| Improper input validation in SiteIsolation in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-87619 | 1 Google | 1 Chrome | 2026-09-09 | 4.3 Medium |
| Observable discrepancy in Prefetch in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-39020 | 2026-09-09 | 5.5 Medium | ||
| An issue in WIngs3D v.2.4.1 allows a local attacker to cause a denial of service via a crafted Wavefront OBJ file | ||||
| CVE-2026-87521 | 1 Google | 1 Chrome | 2026-09-09 | 3.1 Low |
| Information leak in WebMCP in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-87531 | 1 Google | 1 Chrome | 2026-09-09 | 3.1 Low |
| Information leak in CORS in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-87565 | 1 Google | 2 Android, Chrome | 2026-09-09 | 6.5 Medium |
| Information leak in Passwords in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-87566 | 1 Google | 1 Chrome | 2026-09-09 | 5.3 Medium |
| Observable discrepancy in Layout in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-69295 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-09-09 | 7.8 High |
| Out-of-bounds read in Windows USB Driver allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-87437 | 1 Google | 1 Chrome | 2026-09-09 | 6.5 Medium |
| Information leak in Frames in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-87574 | 1 Google | 1 Chrome | 2026-09-09 | 4.3 Medium |
| Information leak in ServiceWorker in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-72977 | 1 Microsoft | 10 365 Apps, Microsoft 365, Office 2019 and 7 more | 2026-09-09 | 6.5 Medium |
| Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-81162 | 2 Drupal, Dxpr Builder Project | 2 Dxpr Builder: The Best Editing (ai) Experience For Drupal, Dxpr Builder | 2026-09-09 | 5.3 Medium |
| Insertion of Sensitive Information Into Sent Data vulnerability in Drupal DXPR Builder: The Best Editing (AI) Experience for Drupal allows Forceful Browsing. This issue affects DXPR Builder: The Best Editing (AI) Experience for Drupal versions: from 0.0.0 to 2.8.1. | ||||
| CVE-2026-87518 | 2 Apple, Google | 2 Iphone Os, Chrome | 2026-09-09 | 5.3 Medium |
| Observable discrepancy in Safebrowsing in Google Chrome on on iOS prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-87477 | 1 Google | 1 Chrome | 2026-09-09 | 6.5 Medium |
| Information leak in Core in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-87593 | 1 Google | 1 Chrome | 2026-09-09 | 6.5 Medium |
| Information leak in Editing in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-16960 | 2026-09-09 | 7.5 High | ||
| The Loops & Logic WordPress plugin before 4.3.0 does not restrict its public template-data action to the data a visitor is permitted to see, allowing unauthenticated users to read arbitrary user records (including email addresses and roles) and arbitrary site options. | ||||
| CVE-2026-80918 | 1 Linux | 1 Linux Kernel | 2026-09-09 | N/A |
| In the Linux kernel, the following vulnerability has been resolved: HID: core: fix number/pointer type confusion on long items When fetch_item() is called by hid_scan_report() on an item with HID_ITEM_TAG_LONG, it stores a pointer to the item data in item->data.longdata instead of storing a value directly in item->data.{u8/u16/u32}. When item_udata() or item_sdata() encounters such an item, it incorrectly assumes that the item is in short format, and therefore returns the lower part of a kernel pointer reinterpreted as a number. When a HID device is connected whose descriptor contains a HID_GLOBAL_ITEM_TAG_REPORT_SIZE encoded in long format with size=4, this causes the lower half of a kernel pointer to be printed into dmesg as a number, like this: hid (null): invalid report_size 107953555 To fix it, let item_udata() and item_sdata() verify that the item is in short format. Note that this bug only affects hid_scan_report(), while the main parsing pass hid_parse_collections() will always bail out when encountering a long item. Sidenote: There are currently no users of data.longdata; maybe we should just remove any parsing of long-format descriptors as a follow-up. | ||||
| CVE-2026-87490 | 1 Google | 1 Chrome | 2026-09-09 | 6.5 Medium |
| Information leak in Transactions Platform in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-87510 | 1 Google | 1 Chrome | 2026-09-09 | 8.3 High |
| Improper input validation in FileAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-58941 | 2026-09-09 | 7.8 High | ||
| In multiple functions of iommu.c, there is a possible out of bounds read/write due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||