By weakness (CWE)

CWE-20: related vulnerabilities

CVEs classified under CWE-20. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

358 published vulnerabilities · page 1 of 4

• CVE-2026-10021HIGH 8.8

  Google Chrome versions before 148.0.7778.216 contain a vulnerability in USB input handling that allows attackers to execute arbitrary code on a user's computer by tricking them into visiting a malicious website. The flaw stems from insufficient validation of untrusted data, meaning Chrome doesn't properly check or sanitize input before processing it through the USB subsystem. An attacker would need to craft a deceptive HTML page and convince a user to visit it, but once clicked, the attack requires no special privileges and can fully compromise the affected system.

• CVE-2026-10037HIGH 8.8

  A vulnerability in OpenJDK on Ubuntu allows a compromised application running in a sandbox to escape that sandbox and execute arbitrary code on the host system. The attack chains through the .jar MIME handler: a malicious app writes a .jar file to disk, marks it executable, and tricks the system into running it outside the sandbox. The vulnerability requires the mailcap package to be installed and exploits the way graphical file handlers trust executable bits without proper containment checks.

• CVE-2026-10904HIGH 8.8

  Google Chrome versions prior to 149.0.7827.53 contain a flaw in the V8 JavaScript engine that allows attackers to break out of the browser sandbox and run malicious code with full privileges. An attacker can exploit this by tricking a user into visiting a specially crafted website. Once triggered, the vulnerability bypasses Chrome's security boundary—the sandbox that normally isolates web content from the rest of the system—giving an attacker direct access to execute arbitrary code on the victim's machine.

• CVE-2026-10922HIGH 8.8

  CVE-2026-10922 is a same-origin policy bypass vulnerability in Google Chrome's Developer Tools that allows an attacker to access data or perform actions they normally shouldn't be able to. The flaw stems from inadequate validation of untrusted input, meaning malicious network traffic can exploit it if a user performs certain interactions with the DevTools interface. While the attack requires user interaction, it carries significant impact—unauthorized access to sensitive information, unauthorized modifications, or disruption of services are all possible. The vulnerability affects Chrome versions prior to 149.0.7827.53 across Windows, macOS, and Linux systems.

• CVE-2026-11041HIGH 8.8

  A vulnerability in Google Chrome's media handling on Windows systems allows an attacker who has already compromised Chrome's renderer process to break out of the browser's security sandbox through a specially crafted web page. This sandbox escape is the critical concern: while the attacker must first gain control of the renderer, doing so grants them access to the underlying Windows system with the privileges of the Chrome user. The vulnerability affects Chrome versions before 149.0.7827.53.

• CVE-2026-11046HIGH 8.8

  A flaw in Google Chrome's media handling allows an attacker who has already compromised the browser's renderer process to break out of the sandbox and run arbitrary code with full system privileges. The vulnerability stems from insufficient validation of untrusted input when processing media files, and requires user interaction (such as opening a crafted HTML page) to trigger. Chrome versions prior to 149.0.7827.53 are affected across Windows, macOS, and Linux systems.

• CVE-2026-11079HIGH 8.8

  Google Chrome contains a vulnerability in its video codec handling that allows attackers to write data outside the intended memory boundaries. An attacker can exploit this by crafting a malicious video file and tricking a user into opening it, potentially allowing the attacker to execute arbitrary code, steal sensitive information, or crash the browser. This affects Chrome versions prior to 149.0.7827.53 across Windows, macOS, and Linux systems.

• CVE-2026-11086HIGH 8.8

  A vulnerability in Google Chrome's Dawn graphics component allows an attacker who has already compromised the browser's renderer process to break out of the sandbox and execute arbitrary code with full system privileges. The attack requires user interaction (opening a malicious HTML page), but once triggered, it completely undermines Chrome's security architecture. Chrome versions prior to 149.0.7827.53 are affected on Windows, macOS, and Linux systems.

• CVE-2026-11202HIGH 8.8

  Google Chrome on iOS versions before 149.0.7827.53 contain a sandbox escape vulnerability triggered by viewing a malicious webpage. An attacker can craft a specially designed HTML page that, when opened in Chrome on an iPhone, could break out of the browser's security sandbox and gain access to the underlying operating system. This means an attacker could potentially read files, install malware, or take control of the device without requiring any special user permissions beyond clicking a link or visiting a website.

• CVE-2026-11235HIGH 8.8

  Google Chrome versions prior to 149.0.7827.53 contain a sandbox escape vulnerability in the compositing system. An attacker who successfully compromises Chrome's renderer process (the sandboxed component responsible for rendering web content) can exploit insufficient policy enforcement to execute arbitrary code with elevated privileges, bypassing the sandbox entirely. The attack requires a crafted HTML page and user interaction, making it a post-compromise threat rather than a direct entry point. While Chromium rated this Low severity, the CVSS score of 8.8 reflects the critical nature of sandbox escapes, which transform a contained renderer compromise into full system code execution.

• CVE-2026-11272HIGH 8.8

  A flaw in Google Chrome's Reading List feature on iOS allows attackers to trick users into performing specific actions (like tapping or swiping) that trigger a privilege escalation attack. An attacker would need to craft a malicious webpage and convince the user to interact with it in a particular way. Once exploited, the attacker gains elevated permissions on the device, potentially compromising sensitive data or device functionality.

• CVE-2026-13706HIGH 8.8

  A flaw in Wikimedia Foundation's UrlShortener component fails to properly validate user input, allowing authenticated users to cause significant harm. An attacker with login credentials can exploit this weakness to read sensitive data, alter information, or disrupt service availability. The vulnerability resides in the UrlShortenerUtils.php file and affects MediaWiki deployments.

• CVE-2026-13777HIGH 8.8

  Google Chrome on iOS contains a vulnerability that allows attackers to trigger heap memory corruption by tricking users into visiting a malicious webpage. The flaw stems from Chrome's iOSWeb component failing to properly validate user-supplied input before processing it. An attacker would need to craft a specially designed HTML page and convince a user to visit it; the user's device would then be at risk of compromise. Chrome versions before 150.0.7871.47 are vulnerable on iOS.

• CVE-2026-13817HIGH 8.8

  A flaw in Chrome's Glic component fails to properly validate user-supplied input before processing it. This weakness allows an attacker to craft a malicious HTML page that, when visited, could break out of Chrome's sandbox—the security boundary that isolates the browser from the underlying operating system. If successful, an attacker gains the ability to execute arbitrary code with the same privileges as the user running Chrome, potentially compromising the entire system.

• CVE-2026-13850HIGH 8.8

  Google Chrome on iOS versions before 150.0.7871.47 contain a flaw that fails to properly validate user-supplied input when handling files. A local attacker could craft a malicious file that, when opened in Chrome on iOS, would execute arbitrary code within the browser's sandbox. While sandboxing limits the scope of potential damage, successful exploitation could allow an attacker to run malicious code on an affected device.

• CVE-2026-13928HIGH 8.8

  Google Chrome versions before 150.0.7871.47 contain a vulnerability that allows attackers to gain elevated privileges on a user's system by tricking them into visiting a malicious webpage. The flaw stems from inadequate checking of user-supplied input, and while Google rates the underlying issue as medium severity, the combination of remote exploitability, user interaction requirement, and high impact consequences results in a CVSS score of 8.8 (HIGH). Users who browse to a specially crafted HTML page could see their Chrome process escalate its privileges, potentially compromising the entire browser context.

• CVE-2026-14009HIGH 8.8

  Google Chrome versions before 150.0.7871.47 contain a flaw in how the browser handles password-related operations that can allow an attacker to corrupt the application's memory. An attacker who crafts a malicious webpage and tricks a user into visiting it could potentially execute arbitrary code or crash the browser. This is not a remote code execution vulnerability that requires no user interaction; the attack requires a user to actually visit a malicious page.

• CVE-2026-14078HIGH 8.8

  A weakness in how Google Chrome handles WebRTC (real-time communication) components fails to properly validate user-supplied input, allowing attackers to trick users into visiting a malicious webpage that could escalate their privileges on the system. The attacker needs the user to click through to a crafted page, but requires no special access or authentication to launch the attack.

• CVE-2026-14084HIGH 8.8

  Google Chrome versions before 150.0.7871.47 contain a vulnerability in its Chromoting remote access feature that fails to properly validate untrusted input from the network. This weakness can allow an attacker to send specially crafted network traffic that corrupts the browser's memory, potentially leading to code execution. The vulnerability requires user interaction—such as establishing or accepting a remote connection—but does not require special privileges to exploit.

• CVE-2026-14087HIGH 8.8

  A heap buffer overflow vulnerability exists in the WebNN (Web Neural Network) component of Google Chrome on Windows systems. The flaw allows a remote attacker who has already compromised the Chrome renderer process to trigger heap memory corruption by crafting a malicious HTML page. While Chromium classifies this as low severity, the CVSS 3.1 assessment reflects the potential for significant impact if exploited, including confidentiality, integrity, and availability violations.

• CVE-2026-39998HIGH 8.8

  Apache APISIX versions 2.12.0 through 3.16.0 contain an input validation flaw in the forward-auth plugin that allows an authenticated attacker to spoof identity headers. By crafting malicious requests, an attacker can bypass intended authentication checks and assume the identity of other users or services, potentially gaining unauthorized access to protected resources.

• CVE-2026-45505HIGH 8.8

  Apache ActiveMQ contains a code injection vulnerability that allows authenticated attackers to execute arbitrary code on the broker. The issue stems from improper validation of discovery wrapper URLs—specifically non-parenthesized formats like `masterslave:vm://...` and `static:vm://`—which bypass a previous security fix. An attacker with valid credentials can exploit the Jolokia JMX-HTTP bridge to load malicious Spring XML configurations, leading to remote code execution with broker privileges.

• CVE-2026-48704HIGH 8.8

  Warp, an AI-assisted development environment, contains a vulnerability that allows malicious Markdown documents or project files to deceive users into executing local files on their system. When a user clicks what appears to be an innocent link in Markdown rendered within Warp, the application may pass the underlying local file path to the operating system's default file handler—potentially launching executables or other dangerous file types rather than safely displaying them. An attacker could craft a project or document with hidden links that exploit this behavior, leading to arbitrary code execution if the user is tricked into clicking. The vulnerability affects versions from October 2023 through early May 2026 and is resolved in the May 6, 2026 stable release.

• CVE-2026-48720HIGH 8.8

  Warp, an AI-assisted terminal and development environment, contains a critical file-handling vulnerability that allows attackers to write arbitrary files to a user's system by embedding specially crafted terminal escape sequences in command output. When a user runs a command that contains a malicious OSC 1337 File payload, Warp will silently decode and save the payload as a local file without prompting the user for confirmation. This affects versions from March 2025 through early May 2026, and has been patched in version 0.2026.05.06.15.42.stable_01.

• CVE-2026-53488HIGH 8.8

  containerd, a widely-used container runtime, has a flaw in how it handles metadata labels embedded in container images. When a container is launched from an image, labels defined in the Dockerfile (via LABEL instructions) are copied to the container without proper validation. A local attacker with user privileges could craft a malicious image with specially crafted labels that, when consumed by certain plugins, could lead to arbitrary command execution on the host system. The issue affects containerd versions before 1.7.33, 2.0.10, 2.1.9, 2.2.5, and 2.3.2.

• CVE-2026-56340HIGH 8.8

  vLLM, a popular open-source framework for large language model inference, contains a validation gap in how it handles tensor data for multimodal embeddings. Versions 0.10.2 through 0.12.x fail to properly validate tensor indices when the prompt-embeddings feature is active. An authenticated attacker can send specially crafted embedding requests with invalid tensor indices (negative or out-of-bounds values) to crash the service, exhaust resources, or potentially corrupt memory. This is a follow-up to an earlier vulnerability (CVE-2025-62164) where the fix only disabled the feature by default rather than validating the input itself.

• CVE-2026-7195HIGH 8.8

  A flaw in Progress Sitefinity's web services allows an unauthenticated attacker to compromise user accounts—stealing login credentials and modifying account data—by exploiting improper input validation. The attack requires tricking a user into interacting with a malicious request and relies on non-standard site configuration, making it a credible but not universally threatening risk. Multiple versions from 14.1 through 15.4 are affected.

• CVE-2026-9211HIGH 8.8

  An unauthenticated attacker on the same local network as a Netgear router can gain full administrative control without needing credentials or user interaction. Once inside, they can modify router settings, redirect traffic, disable security features, or pivot to other systems on the network. The vulnerability affects multiple recent Netgear models and requires only network proximity to exploit.

• CVE-2026-9969HIGH 8.8

  A vulnerability in Google Chrome's ANGLE graphics library (the translation layer that converts graphics commands to platform-specific formats) fails to properly check user-supplied input before processing it. An attacker can exploit this by hosting a specially crafted webpage; when a user visits that page in a vulnerable version of Chrome, the attacker gains the ability to run arbitrary code on the victim's machine with the same privileges as the Chrome process. The attack requires user interaction—specifically, the victim must visit the malicious page—but no special browser settings or additional permissions are needed.

• CVE-2026-11158HIGH 8.6

  A vulnerability in Google Chrome's download handling on macOS allows a local attacker to potentially escape Chrome's sandbox protection using a specially crafted AppleScript command. The issue stems from insufficient validation of user-supplied input. An attacker with local access to an affected Mac could exploit this to break out of the browser sandbox and gain elevated system privileges, though user interaction (such as clicking on a malicious download link or AppleScript trigger) is required.

• CVE-2026-13849HIGH 8.6

  Google Chrome on Windows contains a flaw in its Chromoting component (the remote desktop feature) that fails to properly validate certain user inputs. An attacker with local access to a machine can exploit this by tricking a user into opening a malicious file, potentially breaking out of Chrome's security sandbox and gaining broader system access. The vulnerability affects Chrome versions prior to 150.0.7871.47 on Windows.

• CVE-2026-55602HIGH 8.6

  http-proxy-middleware, a widely-used Node.js library for routing HTTP requests to backend servers, contains a routing bypass flaw affecting versions 0.16.0 through 2.0.9, 3.0.5, and 4.0.x. When administrators configure the library to route requests based on a combination of hostname and path (host+path rules), the library incorrectly matches incoming requests using substring matching instead of exact matching. An attacker can craft a malicious Host header that contains the configured hostname as a substring—but with extra characters appended—and bypass the intended routing restrictions, directing requests to an unintended backend service. This could expose sensitive data, cause unauthorized access, or trigger unintended application behavior depending on what backends are exposed.

• CVE-2026-47201HIGH 8.5

  authentik, an open-source identity provider used to manage user authentication and authorization, contains a vulnerability in how it validates SAML responses from upstream identity providers. The flaw allows an attacker who has any valid account at an upstream IdP to reuse a legitimately signed authentication assertion to impersonate other federated users. This works because authentik doesn't properly validate XML signatures, making it vulnerable to XML Signature Wrapping attacks—a technique where attackers manipulate the structure of signed XML data without invalidating the signature itself. An attacker needs valid credentials at the upstream IdP but can then gain unauthorized access as arbitrary other users in systems relying on authentik for federation.

• CVE-2026-49444HIGH 8.5

  n8n is a popular workflow automation platform that lets teams build integrations and automations without extensive coding. A vulnerability in versions before 1.123.48, 2.21.8, and 2.22.4 allows authenticated users who can create or modify workflows to bypass Python Code Node sandbox protections and execute arbitrary code directly on the task runner container. This requires valid credentials but no special privileges beyond workflow creation rights, making it a significant risk in shared or multi-tenant environments.

• CVE-2026-47931HIGH 8.4

  Adobe ColdFusion versions 2023.19, 2025.8 and earlier contain a flaw that allows attackers with high-level privileges to run malicious code on affected systems without requiring any user to click a link or take action. The vulnerability stems from the application not properly validating input data before processing it. While the attacker needs elevated access to the system, once they exploit this flaw, they can execute arbitrary code with the same permissions as the ColdFusion application itself, potentially compromising data and system integrity.

• CVE-2026-10020HIGH 8.3

  A flaw in Chrome's Skia graphics library on Android allows an attacker who has already compromised Chrome's renderer process to escape the security sandbox and gain full device access. The vulnerability requires the user to visit a specially crafted webpage, but the heavy lifting—compromising the renderer first—means this is a two-stage attack. Chrome versions before 148.0.7778.216 on Android are affected.

• CVE-2026-10911HIGH 8.3

  CVE-2026-10911 is a sandbox escape vulnerability in Google Chrome that allows a remote attacker to break out of the browser's security sandbox if they have already compromised the renderer process. The attack requires crafted HTML content and user interaction, but once successful, it grants an attacker full system access. This is a chained attack scenario: an attacker must first compromise the renderer (the part of Chrome that displays web content) through a separate vulnerability, then use this flaw to escape the sandbox and gain control of the underlying system.

• CVE-2026-10917HIGH 8.3

  Google Chrome versions before 149.0.7827.53 contain a media handling flaw that allows an attacker who has already compromised the browser's renderer process to escape the sandbox and gain broader system access. The vulnerability requires user interaction (visiting a specially crafted webpage) but poses a significant risk because renderer compromises are common entry points in real attacks. Once inside the renderer, the flaw gives an attacker a path to elevated privileges on the underlying operating system.

• CVE-2026-10920HIGH 8.3

  A validation flaw in Chrome's WebShare feature on macOS allows an attacker who has already compromised the browser's renderer process to break out of the sandbox through a specially crafted webpage. This is a post-compromise privilege escalation risk—the attacker must first gain code execution within the renderer, but if successful, can gain full system access. Chrome versions before 149.0.7827.53 are affected.

• CVE-2026-10970HIGH 8.3

  Google Chrome versions prior to 149.0.7827.53 contain a vulnerability in how the browser validates input data related to Interest Groups—a feature used for targeted advertising. An attacker who has already compromised Chrome's renderer process (the part that executes web content) can exploit insufficient input validation to break out of the browser's sandbox—the security boundary designed to isolate web content from the rest of your system. This requires the attacker to first gain renderer access and trick a user into visiting a crafted webpage, but if successful, allows full control over the victim's machine.

• CVE-2026-11237HIGH 8.3

  Google Chrome versions before 149.0.7827.53 contain a vulnerability that allows an attacker who has already compromised Chrome's renderer process to trick users through fake or misleading interface elements displayed on a web page. While the underlying flaw is rated 'Low' severity by Chromium, the impact assessment reflects the potential for convincing visual deception attacks that could mislead users into taking harmful actions.

• CVE-2026-11660HIGH 8.3

  A vulnerability in Google Chrome's New Tab Page feature allows an attacker who has already compromised Chrome's renderer process to escape the browser sandbox using a specially crafted HTML page. This is a critical privilege escalation risk because sandbox escapes can lead to full system compromise. The vulnerability affects Chrome versions before 149.0.7827.103 across Windows, macOS, and Linux.

• CVE-2026-11676HIGH 8.3

  A weakness in how Google Chrome's graphics engine (Dawn) validates user-supplied input can allow an attacker who has already compromised the browser's renderer process to escape the sandbox and gain full system access. The vulnerability exists in Chrome on Linux and ChromeOS versions before 149.0.7827.103, and requires the attacker to trick a user into visiting a malicious webpage. Once the renderer is compromised—typically through a separate browser vulnerability—this flaw becomes a path to break out of Chrome's security isolation and potentially execute arbitrary code with system privileges.

• CVE-2026-11682HIGH 8.3

  A vulnerability in Google Chrome's Views implementation on Linux allows an attacker who has already compromised Chrome's renderer process to break out of the browser sandbox and gain system-level access. The attacker would need to trick a user into visiting a malicious webpage, but the actual exploit requires prior control of Chrome's rendering engine—making this a dangerous second-stage attack vector rather than a direct browser vulnerability. Chrome versions before 149.0.7827.103 on Linux are affected.

• CVE-2026-12009HIGH 8.3

  Google Chrome on macOS contains a vulnerability in its Accessibility feature that could allow an attacker to escape the browser's sandbox—a critical security boundary—if they first compromised Chrome's rendering engine. The flaw stems from insufficient validation of untrusted input. An attacker would need to trick a user into visiting a specially crafted webpage while having already compromised the renderer process, making this a two-stage attack. Versions prior to 149.0.7827.115 are affected.

• CVE-2026-12016HIGH 8.3

  Google Chrome versions before 149.0.7827.115 contain a vulnerability in the DevTools component that allows an attacker to escape the browser's sandbox. The attack requires two preconditions: the attacker must first compromise Chrome's renderer process (the component that executes web content), and the victim must interact with a specially crafted HTML page. Successfully exploiting this flaw could give an attacker full system access, bypassing Chrome's security isolation layer.

• CVE-2026-12034HIGH 8.3

  A flaw in how Google Chrome handles theming files on Linux systems could let an attacker escape the browser's security sandbox if they've already compromised the renderer process. The vulnerability stems from Chrome failing to properly validate untrusted input in its Linux Toolkit Theming component. An attacker would need to trick a user into opening a malicious file to trigger the vulnerability, but successful exploitation could give them full system access beyond the confined browser environment.

• CVE-2026-12465HIGH 8.3

  CVE-2026-12465 is a sandbox escape vulnerability in Google Chrome that stems from improper handling of object lifecycles in the Metrics component. An attacker who has already compromised Chrome's renderer process can exploit a crafted HTML page to break out of the browser sandbox and gain access to the underlying system. This is a post-compromise escalation path that requires the renderer to be compromised first, but once achieved, allows full system access.

• CVE-2026-13025HIGH 8.3

  A race condition in Google Chrome's Developer Tools allows attackers who have already compromised Chrome's renderer process to break out of Chrome's security sandbox and gain access to the underlying operating system. The vulnerability requires the attacker to deliver a specially crafted webpage, but can lead to complete system compromise. This affects Chrome versions before 149.0.7827.197.

• CVE-2026-13813HIGH 8.3

  A security flaw in Google Chrome for iOS allows attackers who have already compromised Chrome's rendering engine to break out of the browser's sandbox—a protective boundary designed to limit damage if a web page is malicious. The attacker would need to craft a specially designed webpage to trigger the escape. This vulnerability affects Chrome versions before 150.0.7871.47 on iOS devices.

• CVE-2026-13829HIGH 8.3

  A flaw in Google Chrome's Settings component on Windows allows an attacker who has already compromised Chrome's rendering engine to break out of the browser's security sandbox and gain broader system access. The vulnerability requires the attacker to first control the renderer process—typically through a separate browser exploit—and then use a specially crafted webpage to escape the sandbox. Chrome versions before 150.0.7871.47 are vulnerable.

• CVE-2026-13834HIGH 8.3

  Google Chrome contains a vulnerability in its ANGLE graphics library that could allow an attacker who has already compromised the renderer process to escape the browser sandbox through a malicious HTML page. The vulnerability stems from insufficient validation of untrusted input. An attacker would need to first compromise the renderer process and trick a user into visiting a crafted page, but successful exploitation would grant access to the full system outside the sandbox protection that normally isolates the browser.

• CVE-2026-14401HIGH 8.3

  A vulnerability in Google Chrome's graphics rendering engine (ANGLE) on Android devices allows an attacker who has already compromised the browser's renderer process to potentially break out of the sandbox through a malicious HTML page. The vulnerability stems from insufficient checking of user input before it's processed by the graphics layer. Chrome version 150.0.7871.46 and earlier on Android are affected.

• CVE-2026-14412HIGH 8.3

  Google Chrome versions prior to 150.0.7871.46 contain a vulnerability in ANGLE (the graphics abstraction layer) that permits sandbox escape. An attacker must first compromise Chrome's renderer process—the isolated component that executes website code—then exploit insufficient input validation to break out of the sandbox entirely. Once escaped, the attacker gains full system access equivalent to the logged-in user. The vulnerability requires user interaction (visiting a malicious page) but not social engineering beyond that.

• CVE-2026-14428HIGH 8.3

  A validation flaw in Chrome's graphics rendering engine (Dawn) on Android allows an attacker who has already compromised the browser's renderer process to escape the sandbox and gain full system access. The vulnerability requires the attacker to have renderer-level access and trick a user into visiting a malicious webpage, but if those conditions are met, it bypasses a critical security boundary that normally prevents browser processes from accessing the underlying operating system.

• CVE-2026-14429HIGH 8.3

  CVE-2026-14429 is a sandbox escape vulnerability in Google Chrome's Skia graphics library. An attacker who has already compromised Chrome's renderer process—the isolated sandbox where web content runs—can exploit insufficient input validation to break out of that sandbox and gain access to the user's full system. The attack requires the renderer to be compromised first and user interaction (such as visiting a malicious webpage), but once those conditions are met, the attacker can potentially access files, install malware, or execute arbitrary code with user privileges.

• CVE-2026-15122HIGH 8.3

  Google Chrome on Windows contains a vulnerability in its codec handling that could allow an attacker who has already compromised the browser's renderer process to break out of the sandbox and gain full system access. The vulnerability requires both a compromised renderer and user interaction with a malicious webpage, but if successfully exploited, it could lead to complete system compromise. Chrome versions prior to 150.0.7871.115 are affected.

• CVE-2026-9880HIGH 8.3

  Google Chrome versions before 148.0.7778.216 contain a flaw in WebGL input validation that allows an attacker who has already compromised the browser's renderer process to escape the browser sandbox and gain full system access. The vulnerability requires user interaction (clicking or otherwise engaging with a malicious page) but poses a critical risk once that initial renderer compromise occurs.

• CVE-2026-9885HIGH 8.3

  A flaw in how Google Chrome validates user interface input on macOS versions prior to 148.0.7778.216 could allow an attacker who has already compromised the browser's rendering engine to break out of Chrome's sandbox. The attacker would need to trick a user into visiting a specially crafted webpage, but once the renderer is compromised, this vulnerability provides a pathway to execute code outside the sandbox with full system privileges.

• CVE-2026-9898HIGH 8.3

  A validation flaw in Google Chrome's GPU handling on Android allows an attacker who has already compromised the browser's renderer process to escape the sandbox through a specially crafted HTML page. This is a post-compromise risk: the attacker must first break into the renderer (via a separate vulnerability or exploit), then leverage this GPU validation gap to break out of Chrome's sandbox and gain full device access.

• CVE-2026-9914HIGH 8.3

  An attacker who gains control of Chrome's rendering engine can use this vulnerability to break out of the browser sandbox by crafting a malicious webpage. The flaw stems from inadequate validation of untrusted data within ANGLE, a graphics abstraction layer, allowing an attacker to execute code with privileges beyond the sandbox constraints.

• CVE-2026-9977HIGH 8.3

  A validation flaw in Chrome's WebShare feature on Android allows an attacker who has already compromised Chrome's renderer process to escape the browser sandbox through a specially crafted HTML page. The vulnerability requires the attacker to have gained initial access to the renderer—typically through a separate exploit or compromise—but once inside, the insufficient input checking creates a pathway to break out of the browser's security boundary and potentially gain full device access.

• CVE-2026-9982HIGH 8.3

  CVE-2026-9982 is a sandbox escape vulnerability in Google Chrome's ANGLE graphics library. An attacker who has already compromised the browser's renderer process can exploit insufficient input validation to break out of the sandbox and gain system-level access. This requires an attacker to first deliver a malicious webpage that triggers the rendering flaw, making it a chained attack scenario rather than a one-step exploitation path.

• CVE-2026-14637HIGH 8.2

  A critical flaw has been discovered in the Ecommerce-CodeIgniter-Bootstrap project that allows attackers to remotely execute arbitrary code by manipulating how the shopping cart data is processed. The vulnerability exploits unsafe deserialization—a process where untrusted data is converted back into executable objects without proper validation. An attacker can send a specially crafted shopping cart parameter to trigger this flaw, potentially compromising the application and any data it handles. The exploit details have already been made public, making this an active threat.

• CVE-2026-45615HIGH 8.2

  CVE-2026-45615 is a memory safety flaw in asn1c, an open-source ASN.1 compiler used to generate code that parses structured data formats. The vulnerability exists in the OER (Octet Encoding Rules) decoder template files generated by asn1c version 1.4 and earlier. When the generated decoder encounters a specially crafted, zero-length OER payload representing a variable-length non-negative integer, it attempts to read the Most Significant Bit without first validating that the payload contains sufficient bytes. This causes a precise one-byte out-of-bounds heap read. Since asn1c-generated parsers are commonly deployed to process untrusted network data—including automotive V2X protocols, 5G telecommunications headers, and X.509 certificates—a remote attacker can trigger this flaw by sending a malicious network message, potentially causing the application to crash or misinterpret critical security-relevant integers.

• CVE-2026-48109HIGH 8.2

  MessagePack for C# contains a flaw in its optional LZ4 decompression feature that allows attackers to craft specially designed messages triggering buffer over-reads. When a vulnerable application receives and decompresses one of these malicious payloads, it can crash with an AccessViolationException, knocking the service offline. In some cases, the over-read may leak small amounts of adjacent memory before the crash occurs. Applications using MessagePack's Lz4Block or Lz4BlockArray compression modes are at risk if they process untrusted or network-sourced MessagePack data.

• CVE-2026-49982HIGH 8.2

  The tmp Node.js library, versions up to 0.2.6, contains a path traversal vulnerability that allows attackers to create files or directories outside the intended temporary directory. The vulnerability exists because the library's path validation only checks string inputs for the '..' substring, but fails to properly validate non-string inputs like Arrays, Buffers, and objects. When these objects are converted to strings during file creation, they can contain path traversal sequences that bypass the check. An attacker can exploit this by sending malicious data through application parameters (such as JSON fields or query strings) that get passed to tmp functions, potentially creating files or directories anywhere on the system with the privileges of the running process.

• CVE-2026-10863HIGH 8.1

  A vulnerability in MISP's correlations endpoint allowed authenticated users to manipulate how search results were ordered by injecting values into the order parameter. Rather than applying a server-defined sort, the application accepted user input that could be passed unsafely to the database layer. An attacker with valid credentials could exploit this to reorder results in ways the application designers didn't intend, potentially exposing information through creative query construction or gaining visibility into data the endpoint should have restricted.

• CVE-2026-11689HIGH 8.1

  A vulnerability in Google Chrome versions before 149.0.7827.103 allows an attacker who has already compromised Chrome's renderer process to break through site isolation—Chrome's security boundary that keeps websites from accessing each other's data. An attacker would need to trick a user into visiting a malicious webpage after the renderer is already compromised, but if successful, they could read or modify sensitive information across different websites.

• CVE-2026-12246HIGH 8.1

  NSD, a popular authoritative DNS nameserver, contains a stack buffer overflow vulnerability triggered when processing specially crafted APL (Address Prefix List) resource records. An authenticated attacker can craft a malicious zone file with an APL record that declares a larger address length than is valid for its address family, causing up to 111 bytes of attacker-controlled data to overwrite the stack when the zone is written to disk. This vulnerability affects NSD version 4.14.0 and requires the attacker to have zone transfer or update privileges.

• CVE-2026-13791HIGH 8.1

  CVE-2026-13791 is a code execution vulnerability in Google Chrome's download handling system that affects versions prior to 150.0.7871.47. The flaw stems from insufficient validation of user-supplied input when processing malicious Chrome extensions. An attacker must first convince a user to install a specially crafted extension, but once installed, the extension can execute arbitrary code with the privileges of the Chrome process. This represents a post-installation code execution risk rather than a browser compromise via web browsing alone.

• CVE-2026-13806HIGH 8.1

  Google Chrome versions before 150.0.7871.47 contain a vulnerability in its Accessibility feature that allows an attacker to break out of the browser's site isolation sandbox. Site isolation is Chrome's defense mechanism that keeps different websites in separate processes so that a compromised website cannot steal data from other sites. This vulnerability requires two conditions: the attacker must first compromise the renderer process (the part of Chrome that runs website code), and the user must visit a malicious HTML page. If both occur, the attacker can bypass site isolation to access data from other open websites.

• CVE-2026-14122HIGH 8.1

  A flaw in Google Chrome's WebAppInstalls feature on Windows allows attackers to read and modify files on a victim's computer by tricking them into visiting a malicious website. The vulnerability requires user interaction—a victim must click or interact with a crafted webpage—but once triggered, it can expose sensitive data or alter files without additional restrictions. Google has patched this in Chrome 150.0.7871.47 and later.

• CVE-2026-35081HIGH 8.1

  A vulnerability in MBS Solutions' gateway and protocol conversion products allows authenticated users to remotely stop arbitrary processes on affected devices. An attacker who already has valid user credentials can exploit insufficient input validation in the ugw-logstop method to terminate critical services, potentially disrupting device functionality or causing a denial of service. This is a HIGH severity issue requiring prompt attention in networked industrial and building automation environments.

• CVE-2026-42588HIGH 8.1

  Apache ActiveMQ's web console exposes a remote interface (Jolokia) that allows authenticated users to interact with the message broker's management functions. An attacker who has legitimate access credentials can craft a specially formed network connector request that tricks the broker into loading and executing arbitrary code hidden in a Spring XML configuration file. The vulnerability exists because the broker doesn't properly validate the input before processing it, and Spring automatically instantiates code within those XML files before any security checks occur.

• CVE-2026-45013HIGH 8.1

  ApostropheCMS, a popular Node.js-based content management system, contains a critical flaw in its password reset functionality. When the application isn't configured with an explicit base URL, it automatically derives the reset link domain from the incoming HTTP Host header—which attackers can manipulate. This means an attacker with knowledge of a victim's email address can trigger a password reset that sends the victim a link pointing to the attacker's server. If the victim clicks it, the valid reset token leaks directly to the attacker, granting them full control of the account. The vulnerability affects all versions up to and including 4.29.0, and no patch has been released as of this publication.

• CVE-2026-45062HIGH 8.1

  FrankenPHP, a PHP application server, contains a critical flaw in how it processes file extensions when request paths include non-ASCII characters. Versions 1.11.2 through 1.12.2 are vulnerable to an attack where an attacker can trick FrankenPHP into executing a non-PHP file as if it were PHP code. If your deployment allows file uploads or stores user-controlled content, an attacker could upload a malicious file and then craft a specially-formed URL to trigger code execution on your server. The vulnerability has been fixed in version 1.12.3.

• CVE-2026-45135HIGH 8.1

  Caddy, a popular TLS-enabled web server platform, contains a flaw in its FastCGI request routing logic that could allow an attacker to execute arbitrary code on affected servers. The vulnerability exists when Caddy processes HTTP requests with non-ASCII characters in the path. An attacker who can upload files or control content served through FastCGI can exploit this misconfiguration to trick Caddy into treating non-script files (like images or documents) as executable scripts, leading to remote code execution. The issue affects versions 2.7.0 through 2.11.2 and is resolved in version 2.11.3.

• CVE-2026-45565HIGH 8.1

  Roxy-WI, a web management interface for popular open-source load balancers and reverse proxes, contains a flaw in how it validates user input across dozens of fields—including SSH credentials and server descriptions. An attacker with login credentials can bypass security checks by appending certain shell metacharacters to a path traversal payload, allowing them to read or modify files outside the intended scope. The vulnerability affects versions 8.2.6.4 and earlier, with no public patches available at publication.

• CVE-2026-47930HIGH 8.1

  Adobe ColdFusion contains a flaw that allows a user with basic system access to bypass built-in security controls and read or modify data they shouldn't be able to access. The vulnerability stems from improper validation of user input and affects multiple recent ColdFusion versions. Notably, an attacker does not need to trick an end user into clicking a malicious link or opening a file—the exploit can happen automatically if an authenticated user with low privileges interacts with an affected application.

• CVE-2026-50632HIGH 8.1

  Apache CXF contains a gap in a previously patched vulnerability that allows remote code execution when untrusted users can configure Java Message Service (JMS) endpoints. This is a second-order fix to CVE-2026-44417, indicating the original patch was incomplete. An attacker with JMS configuration privileges could execute arbitrary code on the system, making this a serious risk for organizations relying on Apache CXF to handle messaging.

• CVE-2026-50633HIGH 8.1

  Apache CXF, a widely-used web services framework, contains a JNDI (Java Naming and Directory Interface) injection flaw in its JCA integration module. An attacker who can modify the JCA deployment descriptor file (ra.xml) or influence runtime activation parameters could inject malicious code that executes with the privileges of the application server. This is a high-risk vulnerability because JNDI injection can lead to full code execution and system compromise.

• CVE-2026-52801HIGH 8.1

  Gogs, a self-hosted Git service, contains a vulnerability in its Mirror Settings feature that allows authenticated users to bypass intended security controls and import local repositories without proper validation. The flaw exists because the SaveAddress function fails to adequately validate user input, creating an alternative attack path that circumvents the more secure New Migration functionality. This issue affects Gogs versions prior to 0.14.3 and requires authentication to exploit.

• CVE-2026-9213HIGH 8.1

  NETGEAR gaming routers are vulnerable to remote code execution if an attacker can intercept and modify network traffic between your router and the internet. The vulnerability affects several popular NETGEAR gaming models. While the attack requires the ability to position oneself in the network path (man-in-the-middle capability), successful exploitation grants the attacker complete control over the router, potentially compromising your entire home or office network.

• CVE-2026-0419HIGH 8.0

  A flaw in NETGEAR's JR6150 AC750 WiFi router allows anyone connected to the local wireless network to run arbitrary operating system commands on the device. The vulnerability stems from inadequate checking of user input before executing system-level operations. Because this router model reached end-of-support in 2018, NETGEAR has stated no security patches will be released. The company recommends replacing affected devices with current models that receive ongoing security updates.

• CVE-2026-11241HIGH 8.0

  A vulnerability in Google Chrome's Cast feature allows an attacker on your local network to escalate their privileges on an affected machine by tricking a user into visiting a specially crafted web page. The attack requires the attacker to already be on your network segment and the user to interact with the malicious page, but once triggered, it grants elevated system access. Google rates this as a low-severity issue in Chromium, yet the CVSS 3.1 score reflects broader impact potential including confidentiality, integrity, and availability compromise.

• CVE-2026-9212HIGH 8.0

  A vulnerability in multiple NETGEAR routers and mesh systems allows users already connected to your local network to run unauthorized commands or change device settings without proper authentication checks. This affects a broad range of NETGEAR models, including mesh systems and enterprise-grade routers. An attacker must be on your network to exploit it, but once there, they can access sensitive data or alter your router's configuration.

• CVE-2025-22424HIGH 7.8

  A vulnerability in Android allows a user with local access to view images that should be restricted to other users. The flaw stems from insufficient validation of user input across multiple code locations. While this requires someone already on the device and user interaction to exploit, it can lead to privilege escalation, meaning an attacker could gain elevated access to sensitive data and system resources.

• CVE-2025-48643HIGH 7.8

  CVE-2025-48643 is a high-severity local privilege escalation vulnerability affecting Google Android. An attacker with basic user-level access to a device can exploit improper input validation in the Android provisioning system to gain full system privileges without needing to execute additional code or interact with the user. Once exploited, the attacker gains complete control over the device, including access to all data and system functions.

• CVE-2026-0078HIGH 7.8

  A flaw in Android's device policy management system allows a local user to escalate their privileges by exploiting improper validation of proxy configuration settings. The vulnerability exists in how the system persists global proxy changes, creating a state mismatch that can be leveraged without requiring special permissions or user interaction. An attacker with basic local access can trigger the flaw to gain elevated system privileges.

• CVE-2026-10942HIGH 7.8

  Google Chrome on Windows contains a UI implementation flaw that allows a local attacker to escalate privileges by opening a malicious file. The vulnerability affects Chrome versions prior to 149.0.7827.53 and requires user interaction (opening a file) but no authentication. If exploited, an attacker could gain elevated system privileges on an affected machine.

• CVE-2026-12191HIGH 7.8

  A flaw in Comma AI's Openpilot version 0.11 allows a local attacker with basic user privileges to execute arbitrary code through unsafe deserialization of pickle files. The vulnerability exists in the model data loading component and requires an attacker to already have access to the system where Openpilot is running. While the attack surface is limited to local access, the impact is severe—an attacker can read, modify, or delete sensitive data, and compromise the integrity of the autonomous driving system.

• CVE-2026-12537HIGH 7.8

  Google's Gemini CLI and its accompanying GitHub Action contain a command injection vulnerability that allows an attacker to execute arbitrary code on a developer's machine or CI/CD pipeline before containerization takes place. An attacker can craft a malicious `.gemini` or `.env` configuration file that, when processed by the vulnerable tool, breaks out of intended command boundaries and runs attacker-controlled commands with the privileges of the user running the tool. This is particularly dangerous in headless CI environments where automation runs without human oversight.

• CVE-2026-13863HIGH 7.8

  A vulnerability in Google Chrome's CustomTabs feature on Android allows a local attacker to gain elevated system privileges by tricking a user into opening a malicious file. The flaw stems from inadequate validation of user-supplied input, meaning Chrome doesn't properly check file contents before processing them through CustomTabs. An attacker with local device access could craft a specially-designed file that, when opened, breaks out of Chrome's normal security boundaries and executes with higher privileges.

• CVE-2026-13927HIGH 7.8

  Google Chrome on Android contains a flaw in how it validates user-provided input within its user interface. A local attacker who can place a specially crafted file on an affected device and convince a user to interact with it could gain elevated privileges on the device. This is a local privilege escalation vulnerability that requires the attacker to already have some presence on the device and user interaction to succeed.

• CVE-2026-14060HIGH 7.8

  A flaw in Chrome's Chromoting component on Windows allows a local attacker to gain elevated privileges by opening a specially crafted file. The vulnerability stems from insufficient validation of untrusted input. To exploit this, an attacker must already have access to the target machine and user interaction is required—the victim must open the malicious file. Chrome versions prior to 150.0.7871.47 are affected.

• CVE-2026-43724HIGH 7.8

  A vulnerability in Apple's operating systems allows a malicious application to terminate the system unexpectedly or write data directly into kernel memory—the privileged core of the operating system. The flaw stems from insufficient validation of user-supplied input. An attacker would need to first gain the ability to run code on the target device, but once installed, the app requires no special permissions or user interaction to trigger the vulnerability. This is a serious local privilege escalation risk affecting iPhones, iPads, and Mac computers.

• CVE-2026-44811HIGH 7.8

  A heap-based buffer overflow exists in Windows DWM (Desktop Window Manager) Core Library that allows a user already logged into a Windows 11 system to elevate their privileges to a higher level of access. An attacker with an existing local account would need to craft specific input or manipulate the DWM process to trigger the memory corruption, potentially gaining system-level permissions. This is a local-only vulnerability and does not enable remote compromise.

• CVE-2026-45636HIGH 7.8

  A heap-based buffer overflow vulnerability exists in Windows NTFS that allows an attacker with local access to execute arbitrary code on affected systems. The vulnerability requires user interaction—such as opening a specially crafted file—but does not require elevated privileges to trigger. Once exploited, an attacker can achieve full system compromise including reading sensitive data, modifying files, and disrupting system availability.

• CVE-2026-9987HIGH 7.8

  A flaw in Google Chrome for Android allows a malicious file to trick the app's installation handler into running unauthorized code on your device. An attacker would need local access (physical proximity or prior compromise) and some user interaction to pull this off. The vulnerability stems from insufficient validation when Chrome processes installation-related files or requests.