Tagged “cve.org”
CVEs tagged cve.org, newest first.
46471 CVEsRSS
CVE-2026-121038Medium· 6.5Information leak in Compositing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page
Information leak in Compositing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)
CVE-2026-121176Medium· 6.5Uninitialized resource in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page
Uninitialized resource in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-121105Medium· 6.5Information leak in Network in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page
Information leak in Network in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-121161Medium· 6.5Information leak in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page
Information leak in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-121132Medium· 6.5Information leak in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page
Information leak in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-121059Medium· 6.5Information leak in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to leak cross-origin data via a crafted HTML page
Information leak in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-121250Critical· 9.6Use after free in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted Chrome extension
Use after free in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security sev…
CVE-2026-121239Medium· 6.5Information leak in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page
Information leak in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-121049Low· 3.3Out of bounds read in V8 in Google Chrome prior to 157.0.8103.38 allowed a local attacker to read memory via a crafted file
Out of bounds read in V8 in Google Chrome prior to 157.0.8103.38 allowed a local attacker to read memory via a crafted file. (Chromium security severity: Medium)
CVE-2026-121113High· 8.8Buffer overflow in PDFium in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted PDF file
Buffer overflow in PDFium in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted PDF file. (Chromium security severity: High)
CVE-2026-121099Medium· 6.5Information leak in PrivateTokens in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page
Information leak in PrivateTokens in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-121158Medium· 6.5Information leak in Paint in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page
Information leak in Paint in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-121254Medium· 6.5Information leak in Select in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page
Information leak in Select in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-121235Medium· 6.5Information leak in Paint in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page
Information leak in Paint in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-121243Medium· 6.5Information leak in Frames in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page
Information leak in Frames in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-121583Medium· 6.3Sanluan PublicCMS TradePaymentService.java TradePaymentService.pendingRefund authorization
A vulnerability was identified in Sanluan PublicCMS 5. This affects the function TradePaymentService.pendingRefund of the file publiccms-parent/publiccms-trade/src/main/java/com/publiccms/logic/service/trade/TradePaymentService.java. The…
CVE-2026-121733Medium· 5.4Bagisto before 2.4.5 Stored XSS via RMA Conversation Attachment Upload
Bagisto before 2.4.5 contains a stored cross-site scripting vulnerability that allows authenticated customers to upload HTML files via the RMA send-message endpoint without type or extension validation. Attackers can upload a .html attac…
CVE-2026-121729High· 8.3emailflare before commit cf31f33 Missing Authorization via /api/keys Routes
emailflare before commit cf31f33 contains a missing authorization vulnerability in the inbox service /api/keys routes that allows any authenticated member to list, create and revoke API keys. Attackers can mint a global live API key acce…
CVE-2026-121535Low· 3.7PoCmiroslavpejic85 MiroTalk P2P Room Action server.js checkPassword excessive authentication
A vulnerability was found in miroslavpejic85 MiroTalk P2P up to 2.0.87. This vulnerability affects the function checkPassword of the file app/src/server.js of the component Room Action Handler. The manipulation results in improper restri…
CVE-2026-121232Medium· 5.1Incorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a local attacker leveraging social engineering to obtain sensitive information via a co-installed app
Incorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a local attacker leveraging social engineering to obtain sensitive information via a co-installed app. (Chromium security severity: Low)
CVE-2026-121081Medium· 5.9UI misrepresentation in Passwords in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to obtain sensitive information via crafted network traffic
UI misrepresentation in Passwords in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to obtain sensitive information via crafted network traffic. (Chromium security severity: Low)
CVE-2026-121194Medium· 5.3Missing authorization in SiteIsolation in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted PDF file
Missing authorization in SiteIsolation in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted PDF file. (Chromium security severity: Medium)
CVE-2026-121039Medium· 5.3Incorrect authorization in Proxy Auth in Google Chrome prior to 157.0.8103.38 allowed an adjacent attacker to obtain sensitive information via crafted network traffic
Incorrect authorization in Proxy Auth in Google Chrome prior to 157.0.8103.38 allowed an adjacent attacker to obtain sensitive information via crafted network traffic. (Chromium security severity: Medium)
CVE-2026-121199Medium· 5.5Missing authorization in Chromoting in Google Chrome on on Mac prior to 157.0.8103.38 allowed a local attacker to obtain sensitive information via a local program
Missing authorization in Chromoting in Google Chrome on on Mac prior to 157.0.8103.38 allowed a local attacker to obtain sensitive information via a local program. (Chromium security severity: Medium)
CVE-2026-121106Medium· 6.5Information leak in Omnibox in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to leak sensitive information via UI Interaction
Information leak in Omnibox in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to leak sensitive information via UI Interaction. (Chromium security severity: Medium)
CVE-2026-121187Medium· 5.3Observable discrepancy in Paint in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page
Observable discrepancy in Paint in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-121130Medium· 5.3Observable discrepancy in Forms in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page
Observable discrepancy in Forms in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-121116Medium· 5.3Missing authorization in WebView in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page
Missing authorization in WebView in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severit…
CVE-2026-121041Medium· 6.5Missing authorization in Input in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page
Missing authorization in Input in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-121091Medium· 5.3Incorrect authorization in Permissions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page
Incorrect authorization in Permissions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)