By weakness (CWE)

CWE-474: related vulnerabilities

CVEs classified under CWE-474. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

3 published vulnerabilities

• CVE-2026-11102HIGH 8.8

  Google Chrome versions before 149.0.7827.53 contain a flaw in how Isolated Web Apps are implemented that could allow an attacker to run malicious code inside Chrome's sandbox. The vulnerability requires user interaction—such as opening a malicious file—but does not require any special privileges. Once triggered, an attacker gains the ability to read sensitive data, modify information, or disrupt availability within the sandbox context.

• CVE-2026-11097MEDIUM 6.5

  Google Chrome on Android contains a flaw in how its WebView component handles cross-origin requests, allowing an attacker to trick users into visiting a malicious webpage that leaks sensitive data from other websites the user is logged into. The vulnerability requires user interaction (clicking a link or visiting a page) but does not require the user to be an administrator or to bypass additional security measures. This affects Chrome versions before 149.0.7827.53.

• CVE-2026-39894LOW 2.9

  Cacti, an open-source performance monitoring framework, has a data integrity flaw in versions 1.2.30 and earlier. The issue stems from how the system handles decimal numbers when the server is configured with certain locales (like German) that use commas instead of periods as decimal separators. When Cacti sends metric data to RRDtool for storage, locale-dependent formatting causes the decimal separator to change from a period to a comma, which RRDtool doesn't recognize. This causes monitoring data to be misaligned or discarded entirely. The flaw requires specific server locale misconfiguration and is not remotely exploitable, but it silently corrupts your metrics—potentially masking real performance issues. The fix is available in version 1.2.31.