Export limit exceeded: 383323 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 383323 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (383323 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-78975 | 1 Google | 1 Chrome | 2026-08-25 | N/A |
| Incorrect authorization in DOM in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-78903 | 1 Google | 1 Chrome | 2026-08-25 | N/A |
| Incomplete cleanup in SiteIsolation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-78962 | 1 Google | 1 Chrome | 2026-08-25 | N/A |
| Uninitialized resource in WebXR in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to potentially leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-79017 | 1 Google | 1 Chrome | 2026-08-25 | N/A |
| Race condition in Extensions in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Low) | ||||
| CVE-2026-78914 | 1 Google | 1 Chrome | 2026-08-25 | N/A |
| Uninitialized resource in Skia in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-79013 | 1 Google | 1 Chrome | 2026-08-25 | N/A |
| Improper input validation in Sync in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via crafted network traffic. (Chromium security severity: Medium) | ||||
| CVE-2026-24262 | 1 Nvidia | 1 Dgx Spark | 2026-08-25 | 8.2 High |
| NVIDIA DGX Spark contains a vulnerability in the system firmware, where a privileged attacker could be able to cause an out-of-bounds write. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, denial of service, information disclosure, and data tampering. | ||||
| CVE-2026-78896 | 1 Google | 1 Chrome | 2026-08-25 | N/A |
| Information leak in StorageAccessAPI in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-78980 | 1 Google | 1 Chrome | 2026-08-25 | N/A |
| Improper input validation in ReaderMode in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass web origin policy into a privileged page via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-78957 | 1 Google | 1 Chrome | 2026-08-25 | N/A |
| Information leak in Mobile in Google Chrome on on iOS prior to 152.0.7977.65 allowed a local attacker to obtain sensitive information via a crafted file. (Chromium security severity: Low) | ||||
| CVE-2026-15089 | 1 Drupal | 1 Commerce Guest Registration | 2026-08-25 | 9.1 Critical |
| Vulnerability in Drupal Commerce guest registration. This issue affects Commerce guest registration versions: *.*. | ||||
| CVE-2026-16644 | 2026-08-25 | N/A | ||
| Incorrect Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.1.0. | ||||
| CVE-2026-16645 | 2026-08-25 | N/A | ||
| Missing Authorization vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Forceful Browsing. This issue affects PhotoSwipe - Responsive JavaScript Modal Image Gallery versions: from 0.0.0 to 3.2.0. | ||||
| CVE-2026-15088 | 2026-08-25 | N/A | ||
| Vulnerability in Drupal Development Environment. This issue affects Development Environment versions: *.*. | ||||
| CVE-2026-18259 | 2026-08-25 | N/A | ||
| Observable Timing Discrepancy vulnerability in Drupal Token Content Access allows Brute Force. This issue affects Token Content Access versions: from 0.0.0 to 3.1.2. | ||||
| CVE-2026-18985 | 2026-08-25 | N/A | ||
| Incorrect Authorization vulnerability in Drupal Edit in-place field allows Forceful Browsing. This issue affects Edit in-place field versions: from 0.0.0 to 2.1.1. | ||||
| CVE-2026-80186 | 1 Redhat | 1 Enterprise Linux | 2026-08-25 | 7.6 High |
| A stack-based buffer overflow vulnerability exists in BlueZ, the Linux Bluetooth protocol stack. A remote user within Bluetooth radio range can send a specially crafted Extended Inquiry Response (EIR) packet that causes a buffer overflow when the target device performs Bluetooth discovery. This vulnerability can lead to a Denial of Service (DoS) by crashing the bluetoothd service and may allow for arbitrary code execution. | ||||
| CVE-2026-78897 | 1 Google | 1 Chrome | 2026-08-25 | N/A |
| Missing authorization in BrowserTag in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted Chrome extension. (Chromium security severity: Low) | ||||
| CVE-2026-45018 | 1 Chainlit | 1 Chainlit | 2026-08-25 | 9.8 Critical |
| Chainlit is a Python framework for building production-ready conversational AI applications. From 2.4.0rc0 until 2.12.0, Chainlit deployments with features.mcp.enabled set to true in .chainlit/config.toml expose the POST /mcp endpoint without requiring authentication. For stdio transport, the endpoint accepts a user-controlled fullCommand string. The validate_mcp_command() function in backend/chainlit/mcp.py checks only the executable name against config.features.mcp.stdio.allowed_executables and passes unchecked arguments to StdioServerParameters in backend/chainlit/server.py. Because npx supports the -c argument, an attacker can execute arbitrary shell commands with the privileges of the Chainlit process. If allowed_executables is unset, its None default is treated as allowing every executable. This issue is fixed in version 2.12.0. | ||||
| CVE-2026-65081 | 1 Nvidia | 1 Nemoclaw | 2026-08-25 | 8.1 High |
| NVIDIA NemoClaw for Linux contains a vulnerability in its installation process, where an attacker could cause execution of untrusted code. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, information disclosure, and denial of service. | ||||