By weakness (CWE)

CWE-669: related vulnerabilities

CVEs classified under CWE-669. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

5 published vulnerabilities

• CVE-2026-14151HIGH 8.3

  Google Chrome versions prior to 150.0.7871.47 contain a flaw in how its AI components handle certain operations, which could allow an attacker to escape the browser's sandbox security boundary. The attack requires two conditions: first, the attacker must already have compromised Chrome's renderer process (the part that displays web pages), and second, the user must interact with a malicious web page. If both conditions are met, the attacker could gain unauthorized access to the system beyond what the sandbox normally permits. While Google rates this as low severity internally, the potential impact—full system compromise through sandbox escape—warrants urgent patching.

• CVE-2026-12068HIGH 7.4

  Avira Password Manager has a flaw that allows attackers to steal login credentials when you're using Firefox. The vulnerability works through a cross-origin iframe trick: when a malicious website embeds a hidden frame pointing to another site, Avira's autofill feature incorrectly fills login credentials intended for the parent page into fields within that hidden frame instead. An attacker can then harvest those credentials. The issue affects Windows, macOS, and Linux users running Avira Password Manager with Firefox.

• CVE-2026-46447MEDIUM 5.8

  OpenStack Ironic versions before 35.0.2 contain a vulnerability that allows an attacker with elevated privileges to inject malicious iPXE boot scripts by modifying node configuration data. An attacker who can alter the driver_info or instance_info fields of a node can supply a specially crafted iPXE script that will execute during the boot process, potentially compromising the integrity of deployed systems. This attack requires authenticated access with administrative or operator-level permissions, but once achieved, can affect multiple systems across a cloud environment.

• CVE-2026-46448MEDIUM 5.4

  OpenStack Nova before version 33.0.2 has a flaw in its server creation API that fails to properly clean up certain hint data sent during instance creation. This results in newly created instances lacking proper Placement allocation, which tracks where compute resources are assigned in the cloud. The vulnerability requires authenticated access but can lead to partial information disclosure and service availability impact.

• CVE-2026-44917MEDIUM 4.9

  A vulnerability in OpenStack Ironic before version 35.0.2 allows authenticated project administrators or managers to read sensitive files directly from the Ironic conductor server through a specially crafted PXE template. This is a credential-required attack where an insider with project admin or manager privileges can exploit the template processing mechanism to access files they shouldn't be able to retrieve, potentially exposing configuration secrets, credentials, or other sensitive data stored on the conductor.