By severity

High-severity vulnerabilities

CVEs rated High by CVSS, with SEC.co remediation and prioritization guidance.

4140 published vulnerabilities · page 8 of 42

• CVE-2026-59723HIGH 8.8

  Cline, an autonomous coding agent available as an SDK, IDE extension, or command-line tool, has a security flaw in its dashboard server that allows malicious websites to take control of a developer's local environment. When you run the `cline dashboard` command on your machine, it starts a web server that listens for connections. Prior to version 3.0.30, this server failed to properly validate incoming WebSocket requests, which means an attacker could craft a malicious website that, if you visit it while the Cline dashboard is running, would gain the ability to read your workspace files, change your AI model and tool settings, and execute commands in your environment. The vulnerability only affects local installations where the ROOM_SECRET protection is not configured—typically the default setup for developers running Cline locally.

• CVE-2026-59734HIGH 8.8

  Coolify, an open-source deployment and server management platform, contains a command injection vulnerability in its health check feature. Authenticated users—those with login credentials—can inject malicious commands that execute inside deployment containers by manipulating health check parameters. The vulnerability affects Coolify versions before 4.0.0-beta.469 and was patched in that release. Because it requires authentication and grants full control over containers, this is a serious risk for multi-tenant or shared Coolify instances.

• CVE-2026-59793HIGH 8.8

  JetBrains TeamCity versions prior to 2026.1.2 contain a flaw in their Perforce version control system integration that allows authenticated users to access files they should not have permission to read. An attacker with valid TeamCity credentials can exploit this to retrieve sensitive files from the server, potentially including configuration data, source code, or other protected assets. This is a post-authentication vulnerability—the attacker must already have a TeamCity account, but the impact is substantial once inside.

• CVE-2026-60102HIGH 8.8

  Horde Virtual File System (VFS) API versions before 3.0.1 contain a vulnerability that allows authenticated users to execute arbitrary commands on systems running the Horde_Vfs_Smb driver. The flaw exists in how the system escapes special characters in filenames—attackers can craft malicious filenames containing shell command sequences that bypass existing protections and execute with system privileges. This happens during file operations like uploads, folder creation, renaming, or deletion. Because the vulnerability requires authentication and affects a specific driver component, the attack surface is limited but serious for organizations using Samba file sharing with Horde.

• CVE-2026-61434HIGH 8.8

  PraisonAI versions prior to 4.6.78 contain a vulnerability in how it filters shell commands. The product attempts to block dangerous commands, but attackers can bypass this protection by using the `find` command's built-in actions (specifically `-exec`, `-execdir`, and `-delete`). This allows an authenticated attacker to read files that should be blocked, delete files, or run unauthorized programs without triggering the security filter. An attacker with login access can exploit this to escalate privileges or access sensitive data.

• CVE-2026-6226HIGH 8.8

  The Frontend Admin plugin for WordPress, maintained by DynamiApps, contains a critical flaw that allows attackers to create administrator accounts without authentication. The vulnerability exists because the plugin accepts form definitions directly from user input rather than retrieving them securely from the database. By crafting a malicious form submission, an attacker can bypass role validation and create a new administrator account, gaining complete control of the WordPress site.

• CVE-2026-6657HIGH 8.8

  A flaw in Jupyter Server allows attackers to bypass its cross-origin request (CORS) validation by exploiting how the software validates the `Origin` header. When administrators configure allowed origins using the `allow_origin_pat` setting, the validation logic uses a partial string match rather than a complete one. This means an attacker can craft a domain like `trusted.example.com.evil.com` that will pass validation meant only for `trusted.example.com`. The vulnerability affects versions 1.12.0 through 2.17.0 and impacts CORS headers, WebSocket connections, referer checking, and login redirects, potentially enabling phishing, code execution, and unauthorized access to APIs.

• CVE-2026-6933HIGH 8.8

  The Premmerce Dev Tools plugin for WordPress contains a critical authorization flaw that allows low-privileged attackers to execute arbitrary code on the server. An attacker with even a Subscriber account can exploit a missing permission check in the plugin's code generation function to inject malicious PHP code into newly created plugin files. When those files are accessed, the injected code runs with full server privileges, giving the attacker complete control over the WordPress installation.

• CVE-2026-7195HIGH 8.8

  A flaw in Progress Sitefinity's web services allows an unauthenticated attacker to compromise user accounts—stealing login credentials and modifying account data—by exploiting improper input validation. The attack requires tricking a user into interacting with a malicious request and relies on non-standard site configuration, making it a credible but not universally threatening risk. Multiple versions from 14.1 through 15.4 are affected.

• CVE-2026-7201HIGH 8.8

  A flaw in Progress Sitefinity's web services allows authenticated users to modify account properties belonging to other users, potentially compromising those accounts. An attacker with valid login credentials can exploit an authorization bypass to access and alter settings or data for accounts that should be restricted from their access level. The vulnerability requires the attacker to know certain user identifiers or properties not typically visible to standard users, which raises the bar somewhat but remains exploitable with reconnaissance.

• CVE-2026-7273HIGH 8.8

  A stack-based buffer overflow flaw exists in the web interface of Zyxel GS1900-48HPv2network switches. An attacker on the same local network can send a specially crafted HTTP request to the affected switch and execute arbitrary commands without needing credentials. This is a serious vulnerability because the attacker requires no authentication and the attack works reliably across local network segments.

• CVE-2026-7387HIGH 8.8

  A privilege escalation vulnerability exists in Mattermost that allows users with basic group-link permissions to promote themselves and other group members to team or channel administrator status without proper authorization checks. An attacker could exploit this by sending specially crafted API requests to the group syncable link and patch endpoints, bypassing the role-management authorization layer. This affects multiple versions across Mattermost 11.6, 11.5, and 10.11 release lines.

• CVE-2026-7465HIGH 8.8

  Spectra Gutenberg Blocks, a WordPress plugin used for building websites with the block editor, contains a critical flaw that allows authenticated contributors and above to execute arbitrary code on the web server. The attack exploits the plugin's block rendering system: an attacker creates a custom block type with a malicious callback function, then triggers it through a second block in the same post, causing the server to run the attacker's code. This affects all versions up to 2.19.25.

• CVE-2026-7569HIGH 8.8

  Quest NetVault Backup contains a Cross-Site Scripting (XSS) vulnerability in its viewclient webpage that allows attackers to bypass authentication and potentially execute malicious code with SYSTEM-level privileges. The attack requires social engineering—an attacker must trick a user into visiting a malicious page or opening a crafted file. Once triggered, the vulnerability can be chained with other flaws to achieve code execution on the backup system, representing a serious threat to data protection infrastructure.

• CVE-2026-7570HIGH 8.8

  A SQL injection vulnerability in Quest NetVault Backup's NVBUDashboard component allows authenticated users to execute arbitrary code on the server. While the vulnerability nominally requires valid credentials, the authentication mechanism can be bypassed, making this effectively an unauthenticated remote code execution risk. An attacker exploiting this flaw gains the privileges of the NETWORK SERVICE account, enabling full system compromise.

• CVE-2026-7654HIGH 8.8

  The Admin Columns plugin for WordPress contains a critical flaw that allows authenticated users—including those with basic contributor permissions—to execute arbitrary code on a website. The vulnerability stems from insecure handling of serialized PHP data in post metadata. An attacker with contributor-level access or higher can craft a malicious serialized object and inject it into a post's custom field, triggering code execution with the privileges of the web server. This affects all versions up to and including 7.0.18.

• CVE-2026-7761HIGH 8.8

  The Ultimate Member WordPress plugin contains a critical chain of three separate logic flaws that attackers can combine to steal password reset links for any user, including site administrators. A contributor-level user (the lowest privilege WordPress role that can create content) can exploit this by creating a specially crafted post with hidden metadata, then manipulating the plugin's member directory feature to expose password reset URLs for the entire user base. Once an attacker obtains an admin's password reset link, they can take over the account without needing the current password.

• CVE-2026-7770HIGH 8.8

  IBM i Access Client Solutions (ACS) versions 1.1.5.0 through 1.1.9.12 contain a remote code execution vulnerability when the software is configured to receive requests from IBM i Navigator. An authenticated attacker can exploit this flaw to execute arbitrary code on the affected system, potentially compromising the entire environment. This is a serious vulnerability affecting a core IBM i administration tool.

• CVE-2026-7802HIGH 8.8

  The Frontend Admin plugin for WordPress contains a critical flaw that allows low-privilege attackers to hijack administrator accounts. Any authenticated user—even with basic subscriber permissions—can change an admin's password, email address, and other profile information by manipulating a form parameter. This transforms a subscriber account into a full site compromise. The vulnerability only affects configurations where the plugin's 'Roles' setting is left unconfigured; properly configured instances with a defined roles list block this attack.

• CVE-2026-7838HIGH 8.8

  UltraVNC viewer versions through 1.8.2.2 contain a critical memory corruption flaw in how they parse error messages from VNC servers. When a malicious or compromised server sends a specially crafted error message during the initial connection phase, the viewer attempts to read far more data than it allocated, overwriting adjacent heap memory. An attacker can exploit this without any valid credentials, potentially executing arbitrary code on the user's machine. The vulnerability occurs before authentication succeeds, making it exploitable by hostile servers or network intermediaries.

• CVE-2026-7870HIGH 8.8

  IBM i versions 7.3 through 7.6 contain a privilege escalation vulnerability arising from improper library resolution. An authenticated user can exploit unqualified library calls to execute arbitrary code with administrator privileges, effectively bypassing access controls. The vulnerability requires valid system access but can be triggered without user interaction, making it a significant risk in environments where IBM i hosts business-critical applications.

• CVE-2026-8071HIGH 8.8

  A vulnerability in the Anti-Spam by CleanTalk WordPress plugin (versions before 6.79) allows attackers to inject malicious scripts into website comments without needing to log in. When site visitors or administrators view affected posts, the injected script executes in their browsers, potentially compromising accounts, stealing data, or spreading malware. The flaw exists in how the plugin's email-encoding shortcode processes user input.

• CVE-2026-8157HIGH 8.8

  The Vitepos WordPress plugin before version 3.4.2 contains a privilege escalation flaw in its REST API. Authenticated users with limited roles can exploit a role-assignment weakness to elevate themselves to administrator status, granting full control of the WordPress site. This requires an attacker to already have valid WordPress credentials, but does not require administrator access initially.

• CVE-2026-8163HIGH 8.8

  The Infility Global WordPress plugin contains a SQL injection flaw affecting versions prior to 2.15.19. An authenticated user—including those with minimal Subscriber-level permissions—can inject malicious SQL commands through insufficiently sanitized parameters, potentially accessing, modifying, or deleting sensitive database contents. This is a serious vulnerability because it requires only basic authentication to exploit, not administrator access.

• CVE-2026-8365HIGH 8.8

  The Blocksy WordPress theme contains a critical flaw that allows authenticated users with contributor-level permissions (or higher) to execute arbitrary code on affected websites. The vulnerability stems from two weaknesses: the theme's REST API endpoint accepts serialized PHP objects without proper validation, and the database migration process automatically deserializes these objects without safety restrictions. An attacker with contributor access can craft a malicious object that triggers unintended code execution when the site is upgraded, effectively giving them full control over the website.

• CVE-2026-8443HIGH 8.8

  The WP Review Slider Pro WordPress plugin contains a SQL injection flaw that allows authenticated users with basic subscriber-level permissions to extract sensitive data from a website's database. The vulnerability stems from improper handling of user input in the plugin's charting functionality—specifically, the code removes WordPress's built-in protections before processing user-supplied data and then directly inserts that data into database queries without additional safeguards. Because the plugin returns the actual SQL queries in its responses, attackers can easily verify whether their injection attempts succeeded, making exploitation straightforward.

• CVE-2026-8444HIGH 8.8

  The WP Review Slider Pro plugin for WordPress contains a SQL injection vulnerability in its AJAX review-finding functionality. Attackers with basic subscriber-level access can inject malicious SQL commands through the 'curselrevs' parameter, allowing them to extract sensitive data from the WordPress database. The vulnerability exists because the plugin fails to properly sanitize user input before constructing database queries.

• CVE-2026-8461HIGH 8.8

  FFmpeg's MagicYUV video decoder contains a flaw that allows an attacker to write data outside the boundaries of an allocated memory region. When exploited, this can crash the application (denial-of-service) or potentially allow the attacker to execute arbitrary code on the victim's system. The vulnerability is triggered when processing specially crafted video files, and requires user interaction—specifically, the victim must open or process the malicious file. All FFmpeg versions before 8.1.2 are affected.

• CVE-2026-8697HIGH 8.8

  A vulnerability in TP-Link Archer C64 v1 routers allows attackers on the local network to repeatedly guess administrative passwords without restriction. The device runs a debug SSH service that shares login credentials with the web interface but fails to limit failed authentication attempts. An attacker who gains valid credentials through brute force can take complete control of the router, potentially redirecting traffic, stealing data, or disrupting network connectivity.

• CVE-2026-8857HIGH 8.8

  A code injection vulnerability exists in MediaWiki's timeline functionality that allows authenticated users to execute arbitrary code on the server. The flaw resides in components responsible for processing timeline data (scripts/EasyTimeline.Pl and includes/Timeline.Php). An attacker with valid login credentials can inject malicious code that will be executed with server privileges, potentially compromising the entire wiki installation. This is a post-authentication attack, meaning the attacker must already have a user account on the target MediaWiki instance.

• CVE-2026-8915HIGH 8.8

  A critical buffer overflow vulnerability exists in Samsung's Escargot JavaScript engine that allows an attacker to write data beyond the boundaries of allocated memory. The vulnerability can be triggered through user interaction (such as opening a malicious webpage or file) and could lead to complete system compromise, including unauthorized data access, system modification, and denial of service. This is a high-severity issue affecting the open-source Escargot project at commit 36f5fb58366a67b713c02f6fd985e924fcc09e31.

• CVE-2026-9009HIGH 8.8

  A critical flaw in the Crawlomatic Multipage Scraper Post Generator WordPress plugin allows authenticated users with author-level permissions or higher to run arbitrary code on websites using affected versions. The vulnerability stems from a shortcode that accepts user input and passes it directly to PHP's call_user_func() function without proper validation, enabling attackers to invoke dangerous PHP commands like system() and shell_exec(). All versions up to and including 2.7.2 are vulnerable.

• CVE-2026-9085HIGH 8.8

  CVE-2026-9085 is a permission and access control flaw in Pardus-Parental-Control (version 0.5.1 and earlier) that allows a local attacker to perform DNS spoofing attacks. Because the software incorrectly assigns permissions to security-critical resources, an attacker with basic local user access can manipulate DNS resolution on the affected system, redirecting network traffic to malicious destinations. This is particularly concerning in environments where Pardus-Parental-Control is deployed to manage network access or security policies.

• CVE-2026-9155HIGH 8.8

  A command injection flaw in Rapid7's InsightConnect Sed Plugin allows authenticated users to run arbitrary system commands on Linux machines. An attacker with valid credentials can exploit insufficient input validation in the expression parameter to execute code with the privileges of the InsightConnect service. This is a local-to-remote escalation risk in automation environments where the plugin processes untrusted expressions.

• CVE-2026-9211HIGH 8.8

  An unauthenticated attacker on the same local network as a Netgear router can gain full administrative control without needing credentials or user interaction. Once inside, they can modify router settings, redirect traffic, disable security features, or pivot to other systems on the network. The vulnerability affects multiple recent Netgear models and requires only network proximity to exploit.

• CVE-2026-9227HIGH 8.8

  The GutenBee – Gutenberg Blocks WordPress plugin contains a file upload validation flaw that allows authenticated users with author-level permissions to upload executable files to a WordPress site. The vulnerability exists because the plugin checks whether a filename contains '.json' anywhere in it, rather than verifying the filename actually ends with '.json'. An attacker could upload a malicious PHP file named 'shell.json.php', which would pass validation but execute as PHP code on the server, leading to remote code execution. All versions up to and including 2.20.1 are affected.

• CVE-2026-9614HIGH 8.8

  Ivanti Neurons for ITSM contains an access control flaw that lets a logged-in user escalate their privileges to admin level. This affects both cloud and on-premises deployments. An attacker who already has valid credentials can exploit this to gain full administrative control without needing to bypass additional authentication steps.

• CVE-2026-9772HIGH 8.8

  Unraid, a popular NAS and virtualization platform, contains a remote code execution vulnerability in its web server that allows authenticated users to run arbitrary commands on the underlying system. The flaw resides in the file upload handler and stems from insufficient validation of user input before it's passed to a system command. An attacker with valid credentials could exploit this to gain code execution as the www-data user, potentially compromising the entire Unraid installation and any data or VMs it hosts.

• CVE-2026-9773HIGH 8.8

  Unraid, a storage and virtualization platform, contains a remote code execution vulnerability in its web server. An authenticated user can craft a malicious request to the ToggleState component that bypasses input validation, allowing them to run arbitrary system commands on the server. The attacker executes code with the privileges of the www-data user (the web server process), potentially compromising the entire Unraid installation and any data it manages.

• CVE-2026-9780HIGH 8.8

  Quest NetVault Backup contains a cross-site scripting (XSS) vulnerability in its addclient3 webpage that allows attackers to bypass authentication and inject malicious scripts. An attacker can craft a malicious webpage or file that, when visited or opened by a NetVault administrator or user, executes arbitrary code with SYSTEM-level privileges. This is a remote vulnerability requiring user interaction but poses significant risk because it can serve as a stepping stone to full system compromise.

• CVE-2026-9781HIGH 8.8

  Quest NetVault Backup contains a SQL injection flaw in its NVBURASDevice JSON-RPC message handler that allows authenticated users—or attackers who bypass authentication—to execute arbitrary code with NETWORK SERVICE privileges. While the vulnerability nominally requires valid credentials, the authentication mechanism itself can be circumvented, making this a practical remote code execution risk for organizations running affected NetVault Backup deployments.

• CVE-2026-9782HIGH 8.8

  Quest NetVault Backup contains a SQL injection vulnerability in its NVBUDeviceDrive JSON-RPC message handler that allows authenticated users to execute arbitrary code on the backup server with NETWORK SERVICE privileges. While the vulnerability requires valid credentials, the authentication mechanism itself can be bypassed, effectively making this exploitable by remote attackers without prior access. This is a critical flaw for organizations relying on NetVault Backup for data protection.

• CVE-2026-9783HIGH 8.8

  A SQL injection flaw in Quest NetVault Backup's NVBURemovableMedia message handler allows authenticated users to inject malicious SQL commands and execute arbitrary code on the backup server. Although the application normally requires login credentials, those authentication checks can be circumvented, making this exploitable by remote, unauthenticated attackers. Code execution runs under the NETWORK SERVICE account, providing significant control over the affected system.

• CVE-2026-9784HIGH 8.8

  Quest NetVault Backup contains a SQL injection vulnerability in its NVBULibraryPort JSON-RPC message handler that allows authenticated attackers to execute arbitrary code on the system. Although the vulnerability nominally requires valid credentials, the authentication mechanism can be circumvented, making this a critical remote code execution risk for organizations running affected NetVault Backup installations. The attacker-controlled code runs with NETWORK SERVICE privileges, potentially granting broad system access.

• CVE-2026-9785HIGH 8.8

  Quest NetVault Backup contains a SQL injection vulnerability in its NVBULibrarySlot JSON-RPC message handler that allows authenticated users to execute arbitrary code on the backup server. While the vulnerability technically requires valid credentials, the authentication mechanism itself can be circumvented, making this effectively unauthenticated remote code execution. An attacker exploiting this flaw gains the privileges of the NETWORK SERVICE account, which typically has broad access to system resources and backup data.

• CVE-2026-9786HIGH 8.8

  Quest NetVault Backup contains a SQL injection vulnerability in its NVBUDashboard component that allows authenticated attackers to execute arbitrary code with NETWORK SERVICE privileges. Although the vulnerability technically requires valid credentials, the authentication mechanism can be bypassed, making this a practical remote code execution risk. The flaw stems from insufficient validation of user-supplied strings in JSON-RPC message processing before they're used in SQL query construction.

• CVE-2026-9787HIGH 8.8

  A flaw in Quest NetVault Backup's logging daemon allows authenticated users to inject system commands through specially crafted JSON-RPC requests, leading to remote code execution with SYSTEM privileges. While the vulnerability nominally requires valid credentials, the authentication mechanism can be circumvented, making this a serious risk for organizations relying on NetVault Backup for data protection.

• CVE-2026-9860HIGH 8.8

  The Cloudflare Images plugin for WordPress contains a critical flaw that allows authors and editors to execute arbitrary code on a website by manipulating a setup parameter. The vulnerability exists because the plugin fails to properly restrict who can modify the WordPress configuration file, and it doesn't adequately escape user input containing single quotes. An attacker with author-level permissions can exploit this during the plugin setup process to inject malicious code directly into the site's core configuration, gaining full server access.

• CVE-2026-9873HIGH 8.8

  A use-after-free memory defect in Google Chrome's Network component allows attackers to run malicious code within the browser sandbox by sending a specially crafted HTML page. The vulnerability requires user interaction—the victim must visit or be directed to the malicious page—but no special browser configuration or privileges are needed to exploit it. Google has rated this as Critical severity due to code execution capabilities, though the CVSS 3.1 score of 8.8 reflects the HIGH severity classification.

• CVE-2026-9878HIGH 8.8

  A use-after-free vulnerability exists in the ANGLE graphics library component of Google Chrome versions before 148.0.7778.216. An attacker can craft a malicious webpage that, when visited, exploits this flaw to execute arbitrary code within Chrome's sandbox environment. The vulnerability requires user interaction (clicking a link or visiting a site) but does not require any special privileges. While the code runs in a sandbox, successful exploitation could allow attackers to steal sensitive data or cause denial of service.

• CVE-2026-9879HIGH 8.8

  A memory safety bug in Chrome's graphics rendering engine (ANGLE) allows attackers to write data outside of allocated memory boundaries. An attacker can craft a malicious HTML page that, when opened in vulnerable versions of Chrome, triggers this out-of-bounds write to execute arbitrary code on the user's system. The vulnerability requires user interaction—specifically, the victim must visit or be directed to the malicious webpage—but no special privileges are needed and the attack works over the network.

• CVE-2026-9883HIGH 8.8

  Google Chrome contains a use-after-free memory safety flaw in its Base component that allows attackers to execute arbitrary code on a user's system when they visit a malicious webpage. The vulnerability requires user interaction (viewing the crafted HTML) but no special privileges, and the attacker can read sensitive data, modify files, or crash the browser. Chrome versions prior to 148.0.7778.216 are affected across Windows, macOS, and Linux platforms.

• CVE-2026-9884HIGH 8.8

  A use-after-free vulnerability in Google Chrome on macOS allows an attacker to run malicious code on a victim's computer by tricking them into visiting a specially crafted website. The vulnerability affects Chrome versions before 148.0.7778.216 on Mac and requires user interaction (clicking a link or viewing a page) but no special privileges to exploit. Google has classified this as a critical security issue in the Chromium project.

• CVE-2026-9887HIGH 8.8

  A memory safety bug in Google Chrome's proxy handling system allows an attacker to craft a malicious Proxy Auto-Config (PAC) script that, when processed by the browser, causes the application to reference memory that has already been freed. This use-after-free condition can be leveraged to execute arbitrary code on a user's system. The vulnerability requires user interaction—specifically, the victim must visit a website or be directed to load a PAC script—but no special privileges are needed from the attacker's perspective. Chrome versions prior to 148.0.7778.216 are affected.

• CVE-2026-9896HIGH 8.8

  A flaw in Google Chrome's V8 JavaScript engine allows attackers to write data outside intended memory boundaries. By crafting a malicious HTML page, an attacker can trigger arbitrary code execution within Chrome's sandbox. The vulnerability requires user interaction—the victim must visit or be directed to a malicious website—but no special privileges are needed. Chrome versions prior to 148.0.7778.216 are affected across Windows, macOS, and Linux platforms.

• CVE-2026-9897HIGH 8.8

  Google Chrome versions prior to 148.0.7778.216 contain a use-after-free vulnerability in the DOM (Document Object Model) that allows attackers to execute arbitrary code within the browser sandbox by tricking users into visiting a crafted webpage. This vulnerability requires user interaction but poses a high risk because successful exploitation grants code execution capabilities inside the sandboxed browser process.

• CVE-2026-9910HIGH 8.8

  A memory safety bug in Google Chrome's graphics engine (ANGLE) allows an attacker to run malicious code within Chrome's sandbox by sending a specially crafted web page to a victim. The vulnerability requires user interaction—specifically visiting a malicious webpage—but no special privileges. Once triggered, an attacker could read sensitive data, modify browser state, or crash the application. This affects Chrome on Windows, macOS, and Linux.

• CVE-2026-9923HIGH 8.8

  A use-after-free vulnerability exists in Skia, the graphics library used by Google Chrome. An attacker can exploit this flaw by hosting a specially crafted HTML page. If a user visits that page while running a vulnerable version of Chrome, the attacker may corrupt memory on the user's system, potentially leading to data theft, system compromise, or browser crashes. The vulnerability requires user interaction (visiting a malicious page) but no special privileges.

• CVE-2026-9927HIGH 8.8

  A use-after-free vulnerability in ANGLE (the graphics translation layer used by Chrome) allows attackers to run malicious code within Chrome's sandbox by tricking users into visiting a specially crafted webpage. The vulnerability exists in Google Chrome versions prior to 148.0.7778.216 and affects Windows, macOS, and Linux systems. While sandboxed, successful exploitation could grant an attacker local execution capabilities on the victim's machine.

• CVE-2026-9928HIGH 8.8

  A memory safety flaw in Google Chrome's ANGLE graphics library allows attackers to read data outside intended memory boundaries. When a user visits a specially crafted webpage, this out-of-bounds read can be weaponized to execute arbitrary code on the affected Windows system. The vulnerability affects Chrome versions prior to 148.0.7778.216 and is rated High severity by Chromium's security team.

• CVE-2026-9938HIGH 8.8

  A flaw in Google Chrome's V8 JavaScript engine allows attackers to execute arbitrary code within the browser's sandbox by tricking users into visiting a malicious webpage. The vulnerability affects Chrome versions before 148.0.7778.216 and requires user interaction (clicking a link or visiting a crafted site). While the code runs in a sandboxed environment, successful exploitation could allow an attacker to break out of Chrome's security boundaries and potentially access system resources or steal sensitive data.

• CVE-2026-9939HIGH 8.8

  A heap buffer overflow vulnerability in Chrome's WebCodecs component allows attackers to execute arbitrary code within Chrome's sandbox by tricking users into visiting a malicious webpage. The vulnerability affects Chrome versions prior to 148.0.7778.216 across Windows, macOS, and Linux platforms. Because it requires user interaction (clicking a link or visiting a site) but can bypass Chrome's sandbox protections, it represents a significant remote code execution risk for Chrome users.

• CVE-2026-9940HIGH 8.8

  A heap buffer overflow vulnerability exists in the ANGLE graphics library used by Google Chrome versions before 148.0.7778.216. An attacker can craft a malicious HTML page that, when visited by a user, corrupts heap memory in the browser process. This memory corruption could allow the attacker to execute arbitrary code or crash the browser. The vulnerability requires user interaction (visiting a malicious website) but does not require any special privileges or complex attack setup.

• CVE-2026-9941HIGH 8.8

  A use-after-free flaw in Chrome's ANGLE graphics library allows attackers to run arbitrary code within Chrome's sandbox by serving a malicious HTML page. An attacker would need to trick a user into visiting a crafted website; no special privileges or system access are required. Chrome versions before 148.0.7778.216 are vulnerable.

• CVE-2026-9945HIGH 8.8

  A use-after-free vulnerability exists in Google Chrome's media handling code on Windows systems. An attacker can craft a malicious HTML page that, when visited by a user, triggers the vulnerability to execute arbitrary code within Chrome's sandboxed environment. This requires user interaction (visiting a link or webpage) but no special privileges, making it a practical attack vector for compromised websites or phishing campaigns.

• CVE-2026-9947HIGH 8.8

  A use-after-free memory vulnerability exists in Google Chrome's XML processing engine that allows an attacker to execute arbitrary code within Chrome's sandbox. An attacker can trigger this vulnerability by crafting a malicious HTML page and convincing a user to visit it. While the sandbox limits damage, successful exploitation could allow the attacker to steal sensitive data or escalate privileges. The vulnerability affects Chrome versions prior to 148.0.7778.216 on Windows, macOS, and Linux systems.

• CVE-2026-9952HIGH 8.8

  A use-after-free vulnerability exists in Google Chrome's WebAudio component that allows attackers to execute arbitrary code within the Chrome sandbox by tricking users into visiting a malicious website. The vulnerability affects Chrome versions prior to 148.0.7778.216 and requires user interaction (clicking a link or visiting a page). While sandboxed, successful exploitation could allow an attacker to run code with the privileges of the Chrome process, potentially leading to data theft or system compromise.

• CVE-2026-9957HIGH 8.8

  Google Chrome's PDF renderer contains a use-after-free vulnerability that allows attackers to run malicious code within Chrome's sandboxed PDF handling process. An attacker can exploit this by sending a specially crafted PDF file to a victim. If the victim opens the PDF in Chrome, the vulnerability triggers, potentially allowing the attacker to escape the sandbox and execute arbitrary code on the system. The vulnerability affects Chrome versions prior to 148.0.7778.216 and impacts users on Windows, macOS, and Linux.

• CVE-2026-9958HIGH 8.8

  A use-after-free vulnerability in PDFium, the PDF rendering engine embedded in Google Chrome, allows attackers to corrupt heap memory when a victim opens a maliciously crafted PDF file. An attacker can trigger this flaw remotely simply by getting someone to view a rigged PDF—no special browser settings or plugins required. This can lead to information disclosure, data corruption, or arbitrary code execution depending on how an attacker chains the memory corruption with other techniques.

• CVE-2026-9961HIGH 8.8

  A use-after-free memory vulnerability exists in Google Chrome's SurfaceCapture component that allows attackers to corrupt heap memory. An attacker can craft a malicious HTML page that, when visited by a user, triggers the flaw to potentially execute arbitrary code with the privileges of the Chrome process. The vulnerability requires user interaction (visiting a malicious site) but has high impact once triggered.

• CVE-2026-9962HIGH 8.8

  A use-after-free memory vulnerability in Google Chrome's WebRTC component allows an attacker to execute arbitrary code within the browser's sandbox by tricking a user into visiting a specially crafted webpage. The attacker gains the ability to read sensitive data, modify information, or crash the browser without needing special privileges or authentication.

• CVE-2026-9965HIGH 8.8

  A memory vulnerability in Google Chrome's ANGLE graphics library allows attackers to corrupt heap memory through a specially crafted webpage. When a user visits a malicious site, the attacker can trigger an out-of-bounds write operation that overwrites data beyond intended memory boundaries. This could lead to arbitrary code execution with the privileges of the browser process. The vulnerability requires user interaction (visiting a malicious page) but is otherwise trivial to deliver via normal web browsing.

• CVE-2026-9968HIGH 8.8

  Google Chrome versions before 148.0.7778.216 contain a flaw in the V8 JavaScript engine that can be triggered by opening a malicious webpage. An attacker can exploit this to run malicious code within Chrome's sandbox—a security boundary meant to isolate the browser from the rest of your system. While the sandbox limits what an attacker can directly access, breaking out of it is a known follow-up risk. The vulnerability requires user interaction (visiting a malicious site) but poses a serious threat because it affects millions of Chrome users across Windows, macOS, and Linux.

• CVE-2026-9969HIGH 8.8

  A vulnerability in Google Chrome's ANGLE graphics library (the translation layer that converts graphics commands to platform-specific formats) fails to properly check user-supplied input before processing it. An attacker can exploit this by hosting a specially crafted webpage; when a user visits that page in a vulnerable version of Chrome, the attacker gains the ability to run arbitrary code on the victim's machine with the same privileges as the Chrome process. The attack requires user interaction—specifically, the victim must visit the malicious page—but no special browser settings or additional permissions are needed.

• CVE-2026-9973HIGH 8.8

  CVE-2026-9973 is a memory corruption vulnerability in Google Chrome's V8 JavaScript engine that allows attackers to run malicious code within the browser's sandbox by hosting a specially crafted HTML page. An attacker would need to trick a user into visiting the malicious site, but once there, the flaw provides a direct path to arbitrary code execution. Chrome versions before 148.0.7778.216 are vulnerable.

• CVE-2026-9976HIGH 8.8

  Google Chrome versions before 148.0.7778.216 contain a flaw in how the browser handles USB device interactions. An attacker can craft a malicious HTML page that, when visited by a user, exploits this flaw to run arbitrary code on the victim's computer with the same privileges as the Chrome process. The vulnerability requires user interaction (visiting the page) but does not require the attacker to have special privileges or be on the same network—it can be delivered remotely via the internet.

• CVE-2026-9978HIGH 8.8

  A use-after-free flaw in Google Chrome's Glic component allows attackers to run arbitrary code within the browser's sandbox by tricking users into visiting a malicious webpage. The vulnerability affects Chrome versions prior to 148.0.7778.216 across Windows, macOS, and Linux. While the code execution is confined to the sandbox, successful exploitation could lead to data theft, credential compromise, or lateral movement depending on the attacker's objectives and the system's security posture.

• CVE-2026-9983HIGH 8.8

  A type confusion vulnerability in Chrome's Skia graphics engine allows attackers to execute arbitrary code within Chrome's sandbox by tricking users into visiting a malicious website. The attacker needs no special privileges—just the ability to craft a deceptive HTML page. Once code runs in the sandbox, it gains significant capabilities including reading sensitive data, modifying content, and disrupting the browser. Chrome version 148.0.7778.216 and later patch this flaw.

• CVE-2026-9984HIGH 8.8

  Google Chrome on Windows contains a use-after-free memory vulnerability in its UI layer that allows attackers to execute arbitrary code on affected systems. The flaw can be triggered by tricking a user into visiting a specially crafted webpage; no special privileges or system access is required from the attacker. This is a remote code execution risk that affects Chrome versions prior to 148.0.7778.216.

• CVE-2026-9992HIGH 8.8

  Google Chrome versions prior to 148.0.7778.216 contain a use-after-free vulnerability in its Network component that allows attackers to execute arbitrary code within the browser's sandbox by tricking users into visiting a malicious website. The vulnerability requires user interaction (clicking a link or visiting a page) but no special privileges, making it a practical attack vector for widespread exploitation.

• CVE-2026-9995HIGH 8.8

  Google Chrome contains a use-after-free memory vulnerability in its WebXR implementation that allows attackers to execute arbitrary code within the browser's sandbox. An attacker can craft a malicious HTML page that, when visited by a user, triggers this flaw to break out of memory protections and run code. This affects Chrome versions prior to 148.0.7778.216 on Windows, macOS, and Linux systems.

• CVE-2026-9999HIGH 8.8

  A flaw in ANGLE, the graphics rendering component within Google Chrome on macOS, allows attackers to break out of the sandbox and run arbitrary code on an affected system. An attacker only needs to trick a user into visiting a malicious webpage—no special permissions or complex attack chains required. The vulnerability has a High severity rating and affects Chrome versions prior to 148.0.7778.216 on Mac systems.

• CVE-2026-10086HIGH 8.7

  A vulnerability in GitLab Enterprise Edition allows an authenticated developer to inject malicious code that runs in another user's browser session. An attacker with developer permissions could craft specially designed input that bypasses GitLab's safeguards, causing victims' browsers to execute arbitrary JavaScript in their security context. This is a stored or reflected cross-site scripting (XSS) vulnerability requiring the attacker to have legitimate developer access and the victim to view the malicious content.

• CVE-2026-10087HIGH 8.7

  GitLab Enterprise Edition contains a cross-site scripting (XSS) vulnerability in its Analytics Dashboard that allows an authenticated developer-level user to inject malicious client-side code that executes in the browser of a targeted user. The flaw stems from insufficient sanitization of user input. Exploitation requires authentication, user interaction (clicking a link or viewing crafted content), and affects multiple version branches released between mid-2024 and early 2026.

• CVE-2026-10643HIGH 8.7

  A flaw in Zephyr's network socket handling allows a local attacker to write beyond the boundary of a caller-supplied buffer when receiving network packets with ancillary data (control messages). The vulnerability stems from incomplete validation of buffer size before writing packet information metadata. An attacker with local user privileges can trigger this by receiving a specially crafted packet, potentially corrupting memory and gaining elevated permissions or crashing the system. The issue affects Zephyr versions 3.6.0 through 4.4.0.

• CVE-2026-12277HIGH 8.7

  The Frontend File Manager Plugin for WordPress (versions through 23.6) contains a critical flaw that allows anyone on the internet to delete files from an affected server without logging in—provided the plugin's guest upload mode is enabled. An attacker can target essential files like wp-config.php, which contains database credentials and security keys. Deleting this file triggers WordPress's setup wizard, giving an attacker a path to take over the entire website. This is a severe threat to WordPress sites relying on this plugin with guest uploads active.

• CVE-2026-14891HIGH 8.7

  HashiCorp Nomad—a popular container orchestration and workload scheduling platform—contains a vulnerability in its Docker task driver that allows someone with job submission privileges to circumvent security controls and mount host filesystem paths into containers. Even when administrators explicitly disable volume bind mounts as a security measure, an attacker can still access host files by exploiting this flaw. This could lead to unauthorized reading or modification of sensitive data on the underlying host system. The issue affects both the open-source Community Edition and the commercial Enterprise Edition across multiple versions.

• CVE-2026-28737HIGH 8.7

  Gitea, a self-hosted Git service, contains a stored cross-site scripting (XSS) vulnerability in versions 1.25.0 through 1.25.x. The flaw exists in the 3D file viewer, which processes glTF (GL Transmission Format) files. An attacker with repository access can craft a malicious glTF file with a weaponized extensionsRequired field that, when viewed by another user, executes arbitrary JavaScript in their browser within the context of the Gitea instance. The XSS is stored, meaning the payload persists in the repository and affects anyone who views the file, not just the initial viewer.

• CVE-2026-35258HIGH 8.7

  Oracle WebLogic Server contains a vulnerability in its Console component that allows an attacker with low-level network access to manipulate critical data or gain unauthorized access to sensitive information. The attack requires some form of user interaction—such as an administrator clicking a malicious link—but once successful, the attacker can read or modify data across the WebLogic environment and potentially affect connected systems. The vulnerability affects versions 14.1.2.0.0 and 15.1.1.0.0.

• CVE-2026-35271HIGH 8.7

  CVE-2026-35271 is a network-accessible vulnerability in Oracle PeopleSoft Enterprise PT PeopleTools (versions 8.61 and 8.62) that allows an unauthenticated attacker to read, modify, or delete sensitive data without authentication. The vulnerability resides in the WebLogic component and is considered difficult to exploit, but successful attacks can compromise both PeopleSoft data and potentially impact other connected systems. The flaw carries a CVSS score of 8.7 (High severity) due to its potential for unauthorized access to critical information.

• CVE-2026-41031HIGH 8.7

  Vinna Process Monitor version 4.0 Service Pack 1 (Build 63255) contains a stored cross-site scripting vulnerability that allows authenticated users with minimal privileges to inject malicious code that persists in the application. When other users—particularly administrators—view the affected content, the injected code executes in their browsers, enabling attackers to steal administrative tokens and session credentials without requiring further user interaction after the initial injection.

• CVE-2026-44494HIGH 8.7

  Axios, a widely-used HTTP client library for JavaScript applications, contains a vulnerability that allows attackers to intercept and modify all network traffic from an affected application. An attacker who can pollute an application's prototype chain (through a separate vulnerability in a dependency) can inject a malicious proxy configuration into Axios. Once injected, Axios will route all HTTP requests—including those carrying authentication credentials—through the attacker's proxy server, enabling complete man-in-the-middle attacks. This affects Axios versions 1.0.0 through 1.15.x; upgrading to 1.16.0 or later eliminates the vulnerability.

• CVE-2026-44543HIGH 8.7

  A flaw in Rancher's Local Path Provisioner allows users with permission to modify a specific Kubernetes configuration file to inject malicious settings into helper pods. These pods run with elevated privileges and can access sensitive host files, other applications' data, and credentials stored on the node. The vulnerability requires the attacker to have legitimate access to edit the configuration—they cannot exploit it remotely or without credentials. The issue is resolved in version 0.0.36.

• CVE-2026-45348HIGH 8.7

  pyLoad is a popular open-source download manager. A vulnerability in its web interface allows attackers to inject malicious JavaScript code. If someone with access to submit download links injects code into a URL, that code executes in the browser of any operator viewing the downloads list. This happens because the application inserts the URL directly into the page without sanitizing it, and the modern theme lacks security policies that would block inline scripts. The vulnerability affects all versions before 0.5.0b3.dev100.

• CVE-2026-45674HIGH 8.7

  Netty, a widely-used framework for building network servers and clients, contains a DNS validation flaw that could allow attackers to trick applications into accepting forged DNS responses. Specifically, the framework fails to properly validate CNAME records—a type of DNS alias—allowing an attacker positioned on the network path or controlling a malicious DNS server to inject false domain mappings. This could redirect traffic intended for legitimate services to attacker-controlled servers, potentially exposing credentials or enabling man-in-the-middle attacks against applications built with affected Netty versions.

• CVE-2026-46392HIGH 8.7

  HAX CMS, a platform for managing microsite deployments with PHP or Node.js backends, contains a file upload bypass vulnerability in versions before 26.0.0. The vulnerability stems from a mismatch between how the application validates uploaded file extensions and how its web server security rules apply. An authenticated attacker can upload an HTML file with an uppercase extension (such as .HTML or .HTM) to bypass security controls that normally force downloaded HTML files rather than displayed them inline. Once bypassed, the HTML executes JavaScript within the HAX CMS origin, potentially allowing account compromise, session hijacking, or lateral movement.

• CVE-2026-46804HIGH 8.7

  Oracle WebCenter Content version 14.1.2.0.0 contains a privilege escalation vulnerability affecting the Content Server component. A low-privileged attacker with network access can exploit this flaw to read sensitive data or modify critical business information. The attack requires the attacker to trick a legitimate user into performing an action—such as clicking a link or opening a document—but the impact extends beyond WebCenter itself, potentially affecting connected systems and downstream applications that depend on WebCenter data.

• CVE-2026-46808HIGH 8.7

  Oracle WebCenter Content version 14.1.2.0.0 contains a privilege-escalation vulnerability accessible over the network that allows attackers with low-level credentials to manipulate or steal sensitive data. The attack requires tricking another user into performing an action (such as clicking a link or opening a file), but once successful, an attacker can read, modify, or delete critical information stored in WebCenter Content or connected systems. The flaw affects authorization controls rather than availability, meaning systems remain operational but security is compromised.

• CVE-2026-47135HIGH 8.7

  vm2 is a popular Node.js sandbox designed to safely execute untrusted code. A flaw in how it protects against dangerous JavaScript symbols allows attackers to bypass the sandbox and execute code with the privileges of the parent Node.js process. An attacker can craft malicious code that obtains cross-realm symbols (special JavaScript objects that exist in the host context), inject them into host objects, and hijack critical host-side functionality—such as the util.promisify method—to gain control over the host environment. The vulnerability affects all versions before 3.11.4.

• CVE-2026-47691HIGH 8.7

  Netty, a widely-used framework for building networked applications, contains a DNS cache poisoning vulnerability in how it validates nameserver records. An attacker who controls an authoritative nameserver for a subdomain can trick Netty into caching false DNS records for parent domains—such as the entire `.co.uk` domain. This happens because Netty's validation logic is too permissive: it accepts nameserver claims from subdomains without properly checking whether those subdomains should actually be trusted to answer queries about their parents. Once the cache is poisoned, all future DNS lookups under the parent domain serve the attacker's malicious responses.