Tagged “cve.org”
CVEs tagged cve.org, newest first.
48071 CVEsRSS
CVE-2026-113039High· 8.8Use after free in Bookmarks in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted Chrome extension
Use after free in Bookmarks in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: Low)
CVE-2026-113088High· 8.8UI misrepresentation in Mobile in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted HTML page
UI misrepresentation in Mobile in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-113812Critical· 9.1Mozilla::CA versions before 20261020 for Perl provide a CA certificate bundle containing a root linked to compromised intermediates
Mozilla::CA versions before 20261020 for Perl provide a CA certificate bundle containing a root linked to compromised intermediates. The bundle includes "emSign ECC Root CA - G3", which provides a trust path for intermediate certificate…
CVE-2025-60496Medium· 5.5PoCA Floating-Point Exception (FPE) in the reframer_send_packet function (/filters/reframer.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.
A Floating-Point Exception (FPE) in the reframer_send_packet function (/filters/reframer.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.
CVE-2026-111758High· 7.5PoCmarkdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0)
markdown-it is a Markdown parser. From versions 14.1.0 to before 14.3.3, and 15.0.0 to before 15.0.3, a link reference definition whose label or title is never closed is O(n²) with default options. Continuation lines are pulled lazily wi…
CVE-2026-113712Medium· 4.8PoCCachet has Stored XSS in Incident Component
Cachet is an open-source status page system. Versions 2.4.1 and earlier have a stored Cross-Site Scripting (XSS) vulnerability in the incident creation form, allowing an authenticated attacker to inject malicious HTML/JavaScript that exe…
CVE-2026-113869Medium· 5.4Use-after-free in S/MIME decryption during a security device password prompt
When Thunderbird asked for a security device password (for example a smartcard PIN or the Primary Password) while decrypting an S/MIME message, the message load could finish or be cancelled while the prompt was open. This freed the messa…
CVE-2026-113868Medium· 5.3Uninitialized memory disclosure and out-of-bounds read in POP3 and SMTP NTLM authentication
When authenticating to a POP3 or SMTP server using NTLM, Thunderbird did not check whether the server's challenge was valid base64. A malicious server could send a challenge that caused Thunderbird to include uninitialized heap memory in…
CVE-2026-113867Critical· 9.1Stanza injection in XMPP chat
Thunderbird did not escape attribute values when serializing outgoing XMPP stanzas. Because values from incoming requests were echoed back in automatic replies, a remote XMPP user could send a crafted request that caused Thunderbird to i…
CVE-2026-86409High· 8.1PoCstale SigV4 headers sent unintended
Setting `CURLOPT_AWS_SIGV4` to NULL but does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent transfer on the same handle still sends an `Authorization: AWS4-HMAC-SHA256` header to whatever URL i…
CVE-2026-113866Medium· 5.9Account password sent unencrypted during Exchange account setup
When setting up an account, Thunderbird's Exchange AutoDiscover lookup also queried the domain's AutoDiscover service over plain HTTP. Due to a bug, that unencrypted request included the credentials the user had entered, allowing a netwo…
CVE-2026-107692Medium· 4.8PoCWar Thunder Account Impersonation
The War Thunder game client transmits its authentication bearer token (auth_jwt) in the very first data packet after the TCP handshake, using only LZ4 compression rather than encryption. An attacker positioned on the network path can pas…
CVE-2026-86411Critical· 9.1PoCFTP connection reuse inherits client-certificate
An `ftp://` transfer configured with `CURLUSESSL_NONE` can reuse a pooled FTP control connection that a previous easy handle upgraded with `STARTTLS` and authenticated using a client certificate. The second handle performs neither a new …
CVE-2026-86410High· 8.1PoCredirect to SFTP or SCP bypasses host verification
A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, and not as a result of following a redirect.
CVE-2026-112380Critical· 9.9Missing authorization in the WhatsApp channel in Kiro Crew
Missing authorization in the WhatsApp group channel in Kiro Crew might allow a remote actor who is a member of an operator-configured WhatsApp group to control the operator's other agent sessions and execute arbitrary commands on the hos…
CVE-2026-86413Critical· 9.1PoCNegotiate credentials sent to redirected origin
When using an *ambient user* in a first transfer doing Negotiate authentication and asked to follow redirects, curl could pass on its credential details to an unrelated second origin when asked to redirect there.
CVE-2026-86412High· 8.1PoCserver-set cookie erases cookie jar
A remote HTTP server can set a cookie that curl accepts and writes to a Netscape cookie jar but cannot reload. On the next invocation using the same path for `--cookie` and `--cookie-jar`, curl fails before connecting, then the cleanup p…
CVE-2026-113709Critical· 9.9Argo CD: A Kustomize Helm config home can run commands in the repo-server
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.1.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, when an operator has enabled --enable-helm for kustomize build, helmGlobals.configHome can point Helm's conf…
CVE-2026-97406Critical· 9.1Authentication Bypass via Bearer Tokens to Unauthorized Credential Minting
XERJ Console API bearer tokens can bypass the passkey‑only authentication requirement and directly invoke the API‑token creation endpoint, allowing unauthorized minting of persistent successor credentials.
CVE-2026-100132Medium· 4.3Acrobat for Edge | Out-of-bounds Read (CWE-125)
Acrobat for Edge is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires u…
CVE-2026-100134High· 8.8Acrobat for Edge | Out-of-bounds Write (CWE-787)
Acrobat for Edge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a mali…
CVE-2026-113708Critical· 9.9Argo CD: A Kustomize remote ref can run commands in the repo-server
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.7.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, Kustomize passes ref or version query values from remote resource, base, or component URLs to git fetch with…
CVE-2026-113643Medium· 4.3PoCEspoCRM PDF Rendering Pipeline ImageSourceProvider.php get authorization
A vulnerability was found in EspoCRM up to 9.3.10/10.0.10. This affects the function ImageSourceProvider::get of the file application/Espo/Tools/Pdf/Dompdf/ImageSourceProvider.php of the component PDF Rendering Pipeline. Performing a man…
CVE-2026-113810High· 7.0Stored XSS on SNS Enrollment Portal
A Stored Cross-Site Scripting vulnerability exists in the SNS enrollment Portal. Through the captive portal an attacker can inject an XSS when requesting certificate creation for user. The stored XSS can only be triggered during valid…
CVE-2026-111088Medium· 6.5Stored XSS in the VPN logs monitor
A Stored Cross-Site Scripting vulnerability exists in the SNS VPN log monitoring screen.
CVE-2026-113808High· 7.1Stored XSS on SNS Enrollment Portal
A Stored Cross-Site Scripting vulnerability exists in the SNS enrollment Portal. Through the captive portal an attacker can inject an XSS when requesting user creation. The stored XSS can only be triggered during validation by the adm…
CVE-2026-111767High· 8.6@modelcontextprotocol/sdk: @modelcontextprotocol/sdk: Unauthorized cross-session task access via taskStore (CVE-2026-111767)
A flaw was found in the Model Context Protocol (MCP) TypeScript SDK (@modelcontextprotocol/sdk). The experimental task storage feature (taskStore) does not verify which client session created a given task when multiple clients share a task…
CVE-2026-113659Medium· 6.1ApostropheCMS: Client-side Prototype Pollution in apos.http.parseQuery leading to DOM-based XSS against authenticated users
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, an unauthenticated attacker can send a crafted link whose query string is automatically parsed by apos.http.parseQuery when an authenticated victim loads…
CVE-2026-113664Medium· 5.3PoCApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring test
ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.0 of the import-export module, an authenticated importer can submit a tar entry whose normalized destination targets a directory while bypassing the literal …
CVE-2026-113662Medium· 5.4ApostropheCMS import-export: NoSQL injection via update-key value lets a crafted import match and overwrite an unidentified document
ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.0 of the import-export module, an authenticated user with import access to a target type can supply an object or operator as an update-key value, causing the…