By year

Vulnerabilities disclosed in 2026

CVEs published in 2026 with SEC.co analysis.

8541 published vulnerabilities · page 12 of 86

• CVE-2026-35262HIGH 8.3

  A vulnerability in Oracle Data Integrator (part of Oracle Fusion Middleware) allows authenticated users on a network to read, modify, or delete sensitive data within the application, and potentially disrupt service. The flaw requires valid credentials but no special privileges—any legitimate user account can trigger it. An attacker with low-level access could escalate impact to critical data loss or unauthorized viewing of all accessible information.

• CVE-2026-35302HIGH 8.3

  Oracle WebLogic Server contains a vulnerability in its administrative console that allows an unauthenticated attacker to potentially take over the server. The attack requires network access and relies on tricking a user into taking action, but once successful, an attacker gains complete control—including the ability to read sensitive data, modify systems, and disrupt operations. Two widely-deployed versions (12.2.1.4.0 and 14.1.1.0.0) are affected. While the flaw lives in WebLogic itself, compromising it can cascade to impact other Oracle Fusion Middleware products running in the same environment.

• CVE-2026-42941HIGH 8.3

  Danelec MacGregor's Voyage Data Recorder (VDR) devices ship with hardcoded default credentials that cannot be forced to change, allowing unauthenticated network attackers to gain administrative access. This is a straightforward but high-impact authentication bypass on a maritime safety-critical system.

• CVE-2026-44698HIGH 8.3

  Home Assistant Companion apps for iOS and Android contain a vulnerability that allows malicious websites viewed in the app to steal a user's access token and run code as if they were logged into Home Assistant. The flaw stems from improper protection of a JavaScript bridge that connects web content to native app functionality. An attacker can craft a webpage with hidden content that tricks the bridge into executing arbitrary commands with the victim's credentials, effectively compromising their Home Assistant account.

• CVE-2026-45567HIGH 8.3

  Roxy-WI, a popular web management interface for load balancers and web servers (HAProxy, Nginx, Apache, and Keepalived), contains an authentication bypass flaw in version 8.2.6.4 and earlier. An attacker can reach the unauthenticated /api/gpt endpoint by crafting a URL containing the 'api' substring, bypassing login requirements. This allows unauthorized access to administrative functions without valid credentials.

• CVE-2026-46307HIGH 8.3

  CVE-2026-46307 is a memory safety bug in the Linux kernel's ath5k WiFi driver. The driver incorrectly writes data beyond the bounds of an array when handling wireless transmission status updates. While the out-of-bounds write itself is narrow in scope—it only affects an adjacent memory field used for signal strength reporting—the vulnerability demonstrates a real flaw that could be triggered during normal WiFi operations. An attacker with network proximity could potentially exploit this to corrupt driver state or trigger unexpected behavior.

• CVE-2026-46481HIGH 8.3

  OpenMetadata users without admin privileges can exploit a workflow testing feature to extract sensitive credentials and authentication tokens. When a non-admin SSO user tests a database connection through the platform's automation interface, the response inadvertently exposes the plaintext database password and a privileged authentication token belonging to the ingestion bot. An attacker with these credentials can then impersonate the bot to access APIs and data that should be restricted to service accounts, effectively escalating their access within the metadata platform. This flaw affects all OpenMetadata versions prior to 1.12.4.

• CVE-2026-46558HIGH 8.3

  Plane, an open-source project management platform, contains a critical authorization flaw that allows any logged-in user to access, modify, and delete files and assets stored in other workspaces they should not have permission to reach. This cross-workspace bypass persists in all versions prior to 1.3.1, making it a significant risk for organizations running multi-tenant Plane deployments where workspace isolation is expected to protect sensitive project data. The vulnerability requires authentication but no special privileges, meaning any team member can exploit it immediately.

• CVE-2026-46925HIGH 8.3

  A vulnerability exists in Oracle Siebel CRM Cloud Applications (versions 17.0 through 26.5) that allows an unauthenticated attacker with physical access to the network segment where the application runs to take over the system entirely. While the flaw is in Siebel itself, successful exploitation can impact other connected systems. The attack is difficult to execute in practice, but if successful, gives an attacker complete control over confidentiality, integrity, and availability of the application.

• CVE-2026-47267HIGH 8.3

  Gogs, a self-hosted Git service, contains a vulnerability that allows attackers to bypass webhook security controls. While the earlier CVE-2022-1285 fix prevents direct connections to internal network addresses, it does not block webhook requests that follow HTTP redirects to those same internal addresses. An attacker can craft a webhook URL pointing to an external server that redirects to an internal system, giving them potential access to sensitive resources within your private network. This flaw has been patched in Gogs version 0.14.3.

• CVE-2026-49203HIGH 8.3

  CVE-2026-49203 is a critical authorization flaw in Acer Connect M6E 5G cellular management APIs. The vulnerability allows an attacker with network access to remotely rewrite or delete eSIM profiles without authentication. Because the affected endpoints lack proper caller verification, an unauthenticated adversary on the same network can manipulate cellular configurations, potentially disconnecting devices or provisioning unauthorized SIM profiles. The flaw exposes organizations relying on these devices for cellular connectivity to profile tampering and service disruption.

• CVE-2026-49229HIGH 8.3

  Actual is a personal finance application that supports multi-user access through OpenID authentication. In versions before 26.6.0, when an administrator disables a user account, the system blocks that user from logging in with OpenID—but any existing session tokens they had obtained before being disabled remain active and valid. This means a disabled user can continue to use the application and access authenticated features as if they were still enabled, bypassing the intended access revocation.

• CVE-2026-49471HIGH 8.3

  Serena is a widely-used AI coding toolkit that includes a web dashboard for interacting with its semantic retrieval and code editing features. Before version 1.5.2, this dashboard ran an unprotected API server on a predictable port without authentication, CSRF defenses, or Host validation. An attacker can exploit this by crafting a malicious webpage; when a user visits it while Serena is running, the attacker's page can communicate directly with the local API via DNS rebinding and inject malicious commands into Serena's persistent memory. Because Serena autonomously reads and executes those commands—particularly through its shell command execution feature—the injected payload runs with the user's privileges. The attack requires only that the victim click a link; no special network position or prior compromise is needed.

• CVE-2026-50023HIGH 8.3

  yt-dlp, a popular command-line tool for downloading audio and video, contains a flaw that allows attackers to plant malicious shortcut files on your system when you download media or subtitles. The vulnerability bypasses a previous security fix by exploiting an allowlist that was meant to preserve legitimate functionality. An attacker could use this to execute code or trick you into running harmful files embedded as .desktop, .url, or .webloc shortcuts.

• CVE-2026-50521HIGH 8.3

  Microsoft Edge (the Chromium-based version) contains a use-after-free memory flaw that allows an authenticated attacker to execute arbitrary code on a target system over the network without requiring user interaction. This is a serious vulnerability because it combines network-based attack delivery with high privileges for code execution, though it does require the attacker to already have valid credentials.

• CVE-2026-50574HIGH 8.3

  yt-dlp, a popular command-line tool for downloading audio and video from the web, contains a security flaw that allows attackers to write arbitrary files to a system when the aria2c external downloader is used with fragmented video formats like HLS or DASH streams. On Windows, this can lead to immediate code execution; on other platforms, malicious code would execute the next time yt-dlp runs. The vulnerability was patched in version 2026.06.09.

• CVE-2026-52920HIGH 8.3

  A bug in the Linux kernel's netfilter subsystem causes IPsec inbound policy rules to be evaluated incorrectly when multiple security transforms are present. The kernel processes the transforms in one direction but checks the policy rules in another, causing mismatches that can allow traffic to bypass intended security policies. An authenticated attacker could potentially exploit this to circumvent firewall rules or access controls relying on IPsec policy enforcement.

• CVE-2026-53814HIGH 8.3

  OpenClaw versions before 2026.5.20 contain a privilege escalation flaw in their hook-triggered agent execution. When a hook is fired, the spawned CLI runtime incorrectly inherits the full scope of the hook's owner instead of being restricted to hook-specific permissions. An attacker who obtains a valid hook token can abuse the /hooks/agent endpoint to run commands with elevated privileges, potentially modifying persistent system state like cron jobs that normally require owner-level access.

• CVE-2026-53831HIGH 8.3

  OpenClaw versions before 2026.5.18 have a vulnerability that lets authenticated operators bypass security rules designed to limit what commands can run on networked systems. By embedding shell metacharacters into otherwise approved commands, an attacker can manipulate how those commands execute and access sensitive files and configuration data that should be off-limits. The vulnerability requires valid operator credentials but poses a significant risk to system confidentiality and integrity.

• CVE-2026-53853HIGH 8.3

  OpenClaw versions prior to 2026.5.12 contain a security flaw that allows authenticated users to bypass restrictions on which command-line arguments can be passed to approved executable programs. An attacker with login access can invoke whitelisted applications with arguments that should be forbidden, potentially gaining unauthorized access to files, establishing network connections, or executing additional commands that the OpenClaw security policy was designed to prevent.

• CVE-2026-54010HIGH 8.3

  Open WebUI, a self-hosted AI platform, contains a privilege escalation vulnerability that allows authenticated users to access files they should not have permission to read or delete. An attacker can attach file references to their own chat messages without validation, then share that chat to gain unauthorized access to those files. This affects versions prior to 0.9.6 and has been patched in the latest release.

• CVE-2026-54100HIGH 8.3

  The Windows Machine Config Operator (WMCO) in Red Hat OpenShift Container Platform fails to verify the identity of Windows worker nodes when establishing SSH connections. An attacker positioned on the same network segment can intercept these connections and steal the credentials used to configure and authenticate Windows nodes within your Kubernetes cluster. This compromises the security posture of Windows infrastructure running on OpenShift.

• CVE-2026-54848HIGH 8.3

  A flaw in the APIExperts Square for WooCommerce plugin allows sensitive information to be leaked when data is transmitted. An attacker can retrieve embedded sensitive data without authentication, affecting all versions through 4.7.3. This is a network-accessible vulnerability that requires no special privileges or user interaction to exploit.

• CVE-2026-55118HIGH 8.3

  CVE-2026-55118 is a privilege escalation vulnerability in Ubiquiti's UniFi Network Application. An attacker who already has network access and low-level privileges can exploit an access control flaw to gain elevated permissions within the application. The vulnerability requires the attacker to already be authenticated or have network-level presence, limiting the scope somewhat, but the impact of successful exploitation is severe—attackers could modify network settings, access sensitive data, or disrupt network operations.

• CVE-2026-55412HIGH 8.3

  ToolJet, an open-source platform for building internal tools and AI agents, contains a server-side request forgery (SSRF) vulnerability in its RestAPI data source component. The vulnerability allows authenticated users to bypass IP-based security filters by using specially crafted DNS names that resolve to Azure's Instance Metadata Service (IMDS). An attacker can exploit this to steal Azure managed identity tokens, granting access to production Kubernetes cluster credentials. The issue affects versions prior to 3.20.178-lts and has been patched in that release.

• CVE-2026-55427HIGH 8.3

  Coder, a platform that helps organizations set up remote development environments, has a vulnerability in versions prior to 2.29.7, 2.32.7, 2.33.8, and 2.34.2. The `coder config-ssh` command copies SSH configuration settings from the Coder server to a developer's local SSH config file without properly validating those settings. An attacker who controls or compromises the Coder server could inject malicious SSH configuration directives—including arbitrary commands—by embedding special characters into fields that get written to the user's SSH config. This could lead to remote code execution when the developer connects via SSH. Exploitation requires either server compromise, administrator access to specific settings, or a network position to intercept communications.

• CVE-2026-55830HIGH 8.3

  RestrictedPython is a sandbox tool that restricts Python code execution to a safe subset of the language, commonly used by embedding applications to safely run untrusted user scripts. A validation bypass was discovered in versions before 8.3 where the library failed to block certain dangerous built-in method names when they appeared as positional-only function arguments. An attacker could define a function with a positional-only parameter named __getattr__, __getitem__, __write__, or __print__ to shadow the sandbox's protective hooks, potentially escaping the intended access restrictions and gaining unauthorized capabilities within the sandbox environment.

• CVE-2026-56215HIGH 8.3

  Capgo versions before 12.128.12 contain a critical account takeover vulnerability. Authenticated attackers can change their email address in the system to match a victim's corporate SSO email, then trigger the SSO provisioning system to merge the victim's identity into the attacker's account. This allows an attacker with basic user access to hijack accounts belonging to other users, particularly those using Single Sign-On (SSO) authentication.

• CVE-2026-56225HIGH 8.3

  Capgo versions before 12.128.2 contain a flaw in how they validate API key permissions. When an API key is created with restricted scope (limited to a specific application), the system fails to properly enforce that restriction. Instead of checking whether the key is authorized to access a particular app, the system only checks organizational scope, allowing a scoped API key to view, modify, or delete other API keys at the account level—even those outside its intended app boundaries. This breaks a fundamental security assumption: that app-scoped credentials should only touch resources within that app.

• CVE-2026-56233HIGH 8.3

  Capgo versions before 12.128.2 contain a path traversal vulnerability that allows authenticated users with build permissions to upload files to unintended locations on the server. By manipulating the upload path with traversal sequences (like `../`), attackers can bypass upload restrictions and access internal administrative endpoints. This grants them privileged API access that should only be available to administrators, leading to server-level privilege escalation. The vulnerability requires prior authentication and build permissions, but once exploited, results in significant system compromise.

• CVE-2026-56305HIGH 8.3

  Capgo versions prior to 12.128.2 have a serious authentication flaw in their password change feature. An attacker who gains even brief access to a user's session—such as through phishing, malware, or a compromised device—can permanently change that user's password without needing to know or verify the old password. This means legitimate users can be locked out of their accounts while attackers gain complete control. The vulnerability requires some level of authentication to exploit, so it's not an open door, but it's a dangerous privilege escalation once inside.

• CVE-2026-56675HIGH 8.3

  9Router, an AI-powered router designed to optimize token usage and costs, contains a critical authentication bypass flaw in versions before 0.5.2. The vulnerability stems from the application trusting all loopback traffic (127.0.0.1) as local, which allows a reverse proxy running on the same host to forward external requests through localhost. This causes the dashboard guard to incorrectly classify remote requests as trusted, granting unauthenticated access to API endpoints that should require authentication. An attacker can exploit this to discover available models, access credentials, and abuse upstream provider integrations.

• CVE-2026-57264HIGH 8.3

  GeoWebPlayer, a plugin used by GeoVision software products (GV-VMS, GV-Cloud, and others), contains an index-out-of-bounds vulnerability in its websocket server. When the server processes commands like setPIP, it fails to validate that the supplied index parameter is within the valid range before using it to access arrays. An attacker with network access can send malformed commands to exploit this weakness, potentially reading sensitive data, modifying system state, or disrupting service availability. The vulnerability requires user interaction in some attack scenarios but has broad impact potential.

• CVE-2026-57265HIGH 8.3

  GeoWebPlayer is a plugin component used by GeoVision software products (GV-VMS, GV-Cloud, and related solutions) to enable advanced web interface functionality through a local WebSocket server. A flaw in this WebSocket server allows unauthenticated remote attackers to send crafted commands with out-of-bounds index values that bypass array bounds checking. This can lead to unauthorized access to sensitive data, modification of system settings, or denial of service. The vulnerability requires user interaction or network proximity to exploit, but once triggered, can affect the broader web interface and potentially downstream systems.

• CVE-2026-57266HIGH 8.3

  GeoWebPlayer, a browser plugin used by GeoVision surveillance software (GV-VMS, GV-Cloud, and related products), contains an array bounds checking vulnerability in its websocket server. When processing certain commands from the local network, the plugin fails to validate an 'index' parameter before using it to access memory arrays. An attacker with network access to the websocket server can supply out-of-bounds index values to trigger memory corruption, potentially leading to information disclosure, code execution, or denial of service. The plugin appears designed for localhost communication, but misconfiguration or network exposure could widen the attack surface.

• CVE-2026-57267HIGH 8.3

  GeoWebPlayer is a plugin that extends web-interface functionality for GeoVision surveillance systems (GV-VMS, GV-Cloud, and related products). It operates a WebSocket server accessible from localhost that accepts administrative commands. A critical flaw exists in how the plugin validates input parameters: when commands reference array indices, the plugin does not properly check whether those indices fall within valid bounds. An attacker who can reach the WebSocket server can supply out-of-bounds index values to access memory regions beyond intended arrays, potentially reading sensitive data, modifying system state, or crashing the service.

• CVE-2026-57268HIGH 8.3

  GeoWebPlayer is a browser plugin used by GeoVision surveillance systems (GV-VMS, GV-Cloud, and related products) to enhance web interface functionality via a local WebSocket server. The plugin fails to validate an 'index' parameter in the `saveVideo` command, allowing an attacker on the local network to access memory regions outside intended array boundaries. By crafting a malicious WebSocket message with an out-of-bounds index, an attacker can read or manipulate critical program state, potentially executing arbitrary code on the system running GeoVision software.

• CVE-2026-57269HIGH 8.3

  GeoWebPlayer is a browser plugin used by GeoVision surveillance software (GV-VMS, GV-Cloud) to enable advanced web interface capabilities via a local websocket server. A critical flaw allows attackers to send specially crafted commands to this local server that bypass index validation checks, enabling out-of-bounds array access. This can lead to unauthorized data exposure, system compromise, or denial of service. The attack requires user interaction (the target must visit a malicious webpage) and network access to the victim's system, but succeeds regardless of whether the user has administrative privileges.

• CVE-2026-57270HIGH 8.3

  GeoWebPlayer, a browser addon for GeoVision surveillance software (GV-VMS, GV-Cloud, and related systems), contains an index validation flaw in its WebSocket server. When processing certain commands, the addon fails to verify that array indices are within valid bounds before accessing memory. An attacker can exploit this by sending specially crafted commands over a network connection to trigger out-of-bounds memory access, potentially leading to information disclosure, system modification, or denial of service.

• CVE-2026-57271HIGH 8.3

  GeoWebPlayer, a browser plugin component of GeoVision's surveillance and video management software, contains a memory safety flaw in how it processes certain pause commands. An attacker can exploit this by crafting a malicious webpage or intercepting network traffic to trigger an out-of-bounds memory access, potentially leading to data theft, system manipulation, or denial of service. The flaw requires user interaction (clicking a link or visiting a compromised site) but can affect multiple GeoVision products including GV-VMS, GV-Cloud, and cloud-based VMS deployments.

• CVE-2026-57272HIGH 8.3

  GeoWebPlayer, a browser addon used with GeoVision surveillance software (GV-VMS, GV-Cloud, and others), contains an array index validation flaw in its websocket server. Attackers who can reach the websocket endpoint—typically requiring local network access or user interaction to trigger—can send specially crafted commands with out-of-bounds index values to read or modify sensitive memory regions. This can lead to information disclosure, system compromise, or denial of service affecting the surveillance infrastructure.

• CVE-2026-57273HIGH 8.3

  GeoWebPlayer is a browser plugin used by GeoVision surveillance software (GV-VMS, GV-Cloud, and related products) to enable advanced web interface functionality, particularly for camera connectivity. The plugin runs a websocket server on the local machine that accepts commands from localhost. A critical flaw exists in how the server processes a specific command called `connectionInfo`, which is designed to retrieve camera connection details. The vulnerability stems from unsafe string handling: the code copies user-supplied JSON data directly into fixed-size memory buffers without length validation, creating a buffer overflow condition. An attacker who can trigger this command with maliciously crafted input could overflow these buffers and potentially execute arbitrary code with the privileges of the process running the websocket server.

• CVE-2026-57274HIGH 8.3

  GeoWebPlayer, a plugin that extends web interface capabilities across GeoVision surveillance software (GV-VMS, GV-Cloud, and others), contains a buffer overflow vulnerability in its local websocket server. An attacker who can interact with the localhost interface can send specially crafted JSON commands to trigger memory corruption, potentially leading to code execution. The vulnerability exists in the command handler that processes camera connection details, specifically in how it copies user-supplied strings into fixed-size buffers without proper length validation.

• CVE-2026-57275HIGH 8.3

  GeoWebPlayer, a browser plugin used with GeoVision surveillance software (GV-VMS, GV-Cloud, and related products), contains a buffer overflow vulnerability in its websocket server. When the server processes a specific command called `connectionInfo` that provides camera connection details, it fails to properly validate the length of user-supplied data before copying it into fixed-size memory buffers. An attacker who can interact with the websocket server—typically through a user visiting a malicious webpage or local network access—could overflow these buffers and potentially execute arbitrary code on the system running the plugin.

• CVE-2026-57276HIGH 8.3

  GeoWebPlayer, a browser plugin that extends GeoVision video management software, contains a buffer overflow vulnerability in how it processes connection commands. An attacker can send a malicious JSON request through the local websocket server to crash the application or potentially execute arbitrary code. The vulnerability requires user interaction and a specific network configuration, but poses significant risk to organizations relying on GeoVision systems for security monitoring.

• CVE-2026-57277HIGH 8.3

  GeoWebPlayer, a browser plugin used by GeoVision surveillance software (GV-VMS, GV-Cloud, and related products), contains a buffer overflow vulnerability in its local websocket server. The flaw exists in how the plugin processes connection information commands—specifically in the `handle_connection_info` function, which copies attacker-controlled JSON data into fixed-size buffers without proper length validation. Because the plugin accepts commands from localhost and is often necessary for web interfaces to function, an attacker with local access or who can trick a user into visiting a malicious webpage while authenticated to the GeoVision interface could overflow these buffers to execute arbitrary code or crash the service.

• CVE-2026-57278HIGH 8.3

  GeoWebPlayer, a browser plugin component shipped with GeoVision surveillance software (GV-VMS, GV-Cloud, and related products), contains a memory safety flaw in its local WebSocket server. The plugin processes JSON commands from the web interface, including one that retrieves camera connection details. An attacker who can control the JSON input—typically through a malicious web page or compromised local web interface—can send oversized strings that overflow fixed-size buffers in the connection handler. This overflow can lead to arbitrary code execution on the system running the GeoVision web service. The vulnerability requires network access and user interaction (clicking a link or visiting a compromised page), but once triggered, allows an unauthenticated attacker to take full control of the affected machine.

• CVE-2026-58170HIGH 8.3

  Vibe-Trading versions before 0.1.10 contain a path traversal vulnerability in how they handle trading proposal identifiers. An authenticated attacker can craft a proposal identifier with path traversal sequences (like '../') to load an arbitrary JSON file from the server as a live trading mandate. When combined with the file upload capability, an attacker can upload a malicious JSON file to a predictable location, then use path traversal to make the application load it as an authoritative trading instruction. Because the application skips validation of trading ceilings when they are absent from the JSON, the attacker gains full control over the committed trading mandate—potentially executing unauthorized trades or modifying trading parameters.

• CVE-2026-58284HIGH 8.3

  Microsoft Edge (Chromium-based) contains an authorization flaw that allows attackers to execute arbitrary code on affected systems over the network. The vulnerability requires user interaction—such as clicking a malicious link or opening a crafted document—but does not require the attacker to be authenticated. Once triggered, an attacker can gain the same privileges as the user running the browser, potentially leading to data theft, system compromise, or lateral movement.

• CVE-2026-58285HIGH 8.3

  Microsoft Edge (Chromium-based) contains a type confusion vulnerability that allows attackers to execute arbitrary code on a user's computer through network-based exploitation. The flaw occurs when the browser processes incompatible data types in memory, leading to a security boundary violation. Successful exploitation requires user interaction—typically visiting a malicious website or opening a crafted link—but does not require the attacker to have any elevated privileges or prior system access.

• CVE-2026-58287HIGH 8.3

  Microsoft Edge (Chromium-based) contains a use-after-free memory vulnerability that allows attackers to execute arbitrary code on a user's system. The flaw requires user interaction—such as visiting a malicious website or opening a crafted file—but once triggered, it can lead to complete system compromise. The vulnerability carries a HIGH severity rating and affects the integrity, confidentiality, and availability of affected systems.

• CVE-2026-58288HIGH 8.3

  Microsoft Edge (Chromium-based) contains a use-after-free memory vulnerability that allows an attacker to execute arbitrary code on a targeted user's machine. The vulnerability requires user interaction—such as visiting a malicious website or opening a crafted file—but does not require the attacker to have prior credentials or system access. Successful exploitation could grant the attacker full code execution capability with the privileges of the user running Edge.

• CVE-2026-58295HIGH 8.3

  Microsoft Edge (Chromium-based) contains a type confusion vulnerability that allows attackers to bypass security features through network requests without requiring user interaction or special privileges. The vulnerability receives a HIGH severity rating due to its network-exploitable nature and potential to undermine browser security controls.

• CVE-2026-58592HIGH 8.3

  Ladybird, a web browser engine, has a memory-safety vulnerability in how it handles WebAssembly modules imported through the ESM (ECMAScript Modules) standard. When JavaScript code imports a WebAssembly function, the browser temporarily creates a function descriptor on the stack. If that descriptor is destroyed before the WebAssembly code finishes using it, the WebAssembly code ends up holding a reference to memory that's no longer valid. An attacker can exploit this stale reference to make the WebAssembly code write data to arbitrary memory locations, potentially achieving code execution within the browser's content process. The flaw requires user interaction (clicking or otherwise engaging with a malicious web page) to trigger, but no special browser features need to be enabled.

• CVE-2026-9877HIGH 8.3

  A use-after-free memory vulnerability in the ANGLE graphics library affects Google Chrome versions before 148.0.7778.216. An attacker who has already compromised Chrome's renderer process can exploit this flaw through a specially crafted HTML page to escape the browser sandbox and gain unauthorized system access. While the attack requires an existing foothold in the renderer, the critical severity designation reflects the severe consequences of a successful sandbox escape.

• CVE-2026-9880HIGH 8.3

  Google Chrome versions before 148.0.7778.216 contain a flaw in WebGL input validation that allows an attacker who has already compromised the browser's renderer process to escape the browser sandbox and gain full system access. The vulnerability requires user interaction (clicking or otherwise engaging with a malicious page) but poses a critical risk once that initial renderer compromise occurs.

• CVE-2026-9885HIGH 8.3

  A flaw in how Google Chrome validates user interface input on macOS versions prior to 148.0.7778.216 could allow an attacker who has already compromised the browser's rendering engine to break out of Chrome's sandbox. The attacker would need to trick a user into visiting a specially crafted webpage, but once the renderer is compromised, this vulnerability provides a pathway to execute code outside the sandbox with full system privileges.

• CVE-2026-9888HIGH 8.3

  A use-after-free vulnerability in Chrome's WebView component on Android allows an attacker with access to the renderer process to potentially escape the sandbox through a specially crafted web page. This is a serious flaw because the renderer is typically isolated for security; if that isolation fails, an attacker could gain deeper system access. The vulnerability affects Chrome versions prior to 148.0.7778.216.

• CVE-2026-9889HIGH 8.3

  A memory safety vulnerability in Google Chrome's graphics rendering engine (Dawn) on Android devices allows an attacker to read and write memory outside intended boundaries. By crafting a malicious HTML page, a remote attacker could potentially escape the Chrome sandbox and gain elevated system privileges. This requires user interaction—the victim must visit the malicious page—but poses a critical threat to Android users.

• CVE-2026-9890HIGH 8.3

  A use-after-free memory flaw exists in Google Chrome's Extended Reality (XR) implementation on Windows. An attacker who has already compromised Chrome's renderer process can exploit this defect through a malicious webpage to break out of the browser sandbox and gain system-level access. This is a privilege escalation attack that requires the renderer to be compromised first, making it part of a multi-stage exploitation chain.

• CVE-2026-9892HIGH 8.3

  A vulnerability in Google Chrome's Skia graphics library on Android could allow an attacker who has already gained control of Chrome's renderer process to break out of the browser sandbox and execute arbitrary code with elevated privileges. An attacker would need to trick a user into visiting a specially crafted website while the renderer has been compromised—a two-step attack requiring both initial compromise and user interaction.

• CVE-2026-9893HIGH 8.3

  A use-after-free vulnerability exists in Google Chrome's Skia graphics library (versions before 148.0.7778.216). An attacker who has already compromised Chrome's renderer process can exploit this flaw through a specially crafted HTML page to escape the browser sandbox—potentially gaining full system access. While the attack requires an initial compromise of the renderer, the sandbox escape risk elevates this to a critical concern for organizations where Chrome is prevalent.

• CVE-2026-9894HIGH 8.3

  Google Chrome versions before 148.0.7778.216 contain a use-after-free vulnerability in the GPU rendering process. An attacker who has already compromised Chrome's renderer process can exploit this flaw via a malicious HTML page to escape the browser's sandbox and gain broader system access. This is a post-compromise escalation risk, not a direct infection vector.

• CVE-2026-9895HIGH 8.3

  Google Chrome versions prior to 148.0.7778.216 contain an out-of-bounds read vulnerability in the GPU processing component. An attacker who has already compromised a renderer process can exploit this flaw by serving a specially crafted HTML page, potentially escaping the browser sandbox entirely. This is a critical chaining vulnerability—it requires prior renderer compromise but enables full system access.

• CVE-2026-9898HIGH 8.3

  A validation flaw in Google Chrome's GPU handling on Android allows an attacker who has already compromised the browser's renderer process to escape the sandbox through a specially crafted HTML page. This is a post-compromise risk: the attacker must first break into the renderer (via a separate vulnerability or exploit), then leverage this GPU validation gap to break out of Chrome's sandbox and gain full device access.

• CVE-2026-9899HIGH 8.3

  A use-after-free memory defect in ANGLE (the graphics abstraction layer used by Chrome) can allow an attacker to escape Chrome's sandbox if they've already compromised the renderer process. The attack requires a specially crafted web page and user interaction, but successful exploitation could give an attacker full system access beyond Chrome's security boundaries.

• CVE-2026-9900HIGH 8.3

  A memory safety bug in Chrome's graphics rendering engine (ANGLE) allows attackers to write data outside allocated memory bounds. If an attacker can compromise Chrome's renderer process—the part that displays web content—they can exploit this flaw to break out of Chrome's sandbox and gain full system access. This requires both process compromise and a user to visit a malicious page, but the consequences are severe.

• CVE-2026-9902HIGH 8.3

  A use-after-free memory bug in Google Chrome's accessibility features could allow an attacker to escape the browser's sandbox if they first compromise the renderer process. The vulnerability affects Chrome versions before 148.0.7778.216 and requires the attacker to trick a user into visiting a crafted webpage. While the initial compromise of the renderer process is a significant prerequisite, successfully exploiting this flaw could grant an attacker system-level access beyond the browser's normal restrictions.

• CVE-2026-9904HIGH 8.3

  A use-after-free memory vulnerability exists in ANGLE, the graphics abstraction layer used by Google Chrome. By delivering a specially crafted HTML page, a remote attacker could exploit this flaw to break out of Chrome's sandbox—the critical security boundary that isolates the browser process from the rest of your system. Successful exploitation allows the attacker to run arbitrary code with the privileges of your user account, potentially compromising your entire machine.

• CVE-2026-9905HIGH 8.3

  A use-after-free vulnerability exists in Google Chrome's accessibility features on Windows. An attacker who has already compromised Chrome's renderer process can exploit this flaw through a specially crafted HTML page to break out of Chrome's sandbox and gain system-level access. This is a post-compromise risk: the attacker must first have control of the renderer, but if they do, this vulnerability provides a direct path to escape Chrome's security isolation and potentially take full control of your computer.

• CVE-2026-9906HIGH 8.3

  Google Chrome versions prior to 148.0.7778.216 contain a memory safety flaw in GPU processing that could allow an attacker with control of the browser's renderer process to break out of the sandbox and gain system-level access. The attack requires the renderer to already be compromised and the user to visit a malicious webpage, but success would bypass Chrome's primary security boundary.

• CVE-2026-9914HIGH 8.3

  An attacker who gains control of Chrome's rendering engine can use this vulnerability to break out of the browser sandbox by crafting a malicious webpage. The flaw stems from inadequate validation of untrusted data within ANGLE, a graphics abstraction layer, allowing an attacker to execute code with privileges beyond the sandbox constraints.

• CVE-2026-9915HIGH 8.3

  A heap buffer overflow vulnerability exists in ANGLE, the graphics abstraction layer used by Google Chrome, affecting versions prior to 148.0.7778.216. An attacker who has already compromised Chrome's renderer process can exploit this flaw via a specially crafted HTML page to potentially escape the browser sandbox and gain elevated privileges on the system. This requires the attacker to first compromise the renderer, making it a post-compromise threat rather than a direct entry point.

• CVE-2026-9916HIGH 8.3

  A memory safety flaw exists in the ANGLE graphics library component of Google Chrome. An attacker who has already compromised the browser's renderer process could exploit this out-of-bounds write to break out of the browser sandbox and gain system-level access. Exploitation requires the attacker to deliver a crafted HTML page and needs user interaction to trigger. The vulnerability affects Chrome versions before 148.0.7778.216.

• CVE-2026-9924HIGH 8.3

  A flaw in the ANGLE graphics library (which Chrome uses to render graphics on Windows) can cause memory corruption when processing specially crafted web content. An attacker who has already compromised Chrome's sandboxed renderer process could exploit this to escape the sandbox and gain full system access. The vulnerability requires user interaction—the victim must open a malicious webpage—but once the renderer is compromised, the attacker has a path to execute code outside the sandbox.

• CVE-2026-9925HIGH 8.3

  A use-after-free flaw in ANGLE (the graphics abstraction layer used by Google Chrome) can allow an attacker to escape the browser sandbox if they first compromise the renderer process. The attacker would craft a malicious HTML page to trigger memory corruption that leads to code execution outside the sandbox boundary. This requires two conditions: initial renderer compromise and user interaction with the hostile page.

• CVE-2026-9926HIGH 8.3

  A memory error in Chrome's graphics processing component (ANGLE) could allow an attacker who has already compromised the renderer process to break out of the sandbox and access the wider system. The vulnerability requires the attacker to deliver a specially crafted webpage and the user to interact with it, but once triggered, it could lead to full system compromise. The issue affects Chrome versions prior to 148.0.7778.216.

• CVE-2026-9931HIGH 8.3

  A use-after-free memory flaw in Chrome's GPU component allows an attacker who has already compromised the browser's renderer process to break out of Chrome's sandbox and gain system-level access. The attacker would need to trick a user into visiting a malicious webpage while the renderer is already under attack. This is a post-compromise privilege escalation path rather than a direct remote attack vector.

• CVE-2026-9932HIGH 8.3

  A use-after-free vulnerability exists in the ANGLE graphics library within Google Chrome on Windows. An attacker who has already compromised Chrome's renderer process can exploit this flaw via a specially crafted HTML page to break out of Chrome's sandbox and gain full system access. This is a chained attack: the initial compromise must occur first, but once inside the renderer, the attacker gains significant additional capabilities.

• CVE-2026-9936HIGH 8.3

  A use-after-free vulnerability in Google Chrome's graphics rendering engine (GFX) affects Mac systems running versions prior to 148.0.7778.216. The flaw allows an attacker who has already compromised Chrome's renderer process to escape the browser sandbox through a malicious HTML page, potentially gaining access to the underlying operating system. This is a post-compromise attack requiring the renderer to already be under attacker control.

• CVE-2026-9937HIGH 8.3

  A use-after-free flaw in Google Chrome's user interface on Windows allows an attacker who has already compromised Chrome's renderer process to escape the browser sandbox and gain system-level access. The attacker would need to craft a malicious HTML page to trigger the vulnerability. This is a critical privilege escalation path because sandbox escapes turn browser compromises into full system compromises.

• CVE-2026-9946HIGH 8.3

  A use-after-free vulnerability in Google Chrome's ANGLE graphics library could allow an attacker who has already compromised the browser's renderer process to break out of Chrome's security sandbox and execute code with system-level privileges. The flaw affects Chrome versions before 148.0.7778.216 and requires user interaction—typically visiting a malicious website—to trigger the vulnerability chain.

• CVE-2026-9948HIGH 8.3

  Google Chrome on macOS contains a use-after-free vulnerability in its Views component that could allow an attacker to escape the browser's sandbox. The attack requires two conditions: the attacker must first compromise Chrome's renderer process (the sandboxed component that executes web content), and the victim must interact with a specially crafted webpage. If successful, the attacker gains access beyond the sandbox, potentially compromising the entire system. This vulnerability affects Chrome versions prior to 148.0.7778.216 on macOS.

• CVE-2026-9949HIGH 8.3

  A use-after-free memory vulnerability exists in Google Chrome's Core component on Windows that could allow an attacker to escape the browser's sandbox. The vulnerability requires the attacker to have already compromised Chrome's renderer process and trick a user into visiting a malicious webpage. If successfully exploited, an attacker could gain the same privileges as the Windows user running Chrome, potentially compromising the entire system.

• CVE-2026-9951HIGH 8.3

  Google Chrome before version 148.0.7778.216 contains a use-after-free vulnerability in its user interface rendering engine. This flaw allows an attacker to craft a malicious HTML page that, when visited by a user, can trigger memory corruption. The vulnerability is particularly dangerous because it may enable attackers to break out of Chrome's sandbox—the security boundary that isolates the browser from the underlying operating system—potentially gaining direct access to system resources and user data. Exploitation requires user interaction (clicking or visiting a malicious site) and involves complex attack conditions, but the potential for sandbox escape elevates the risk significantly.

• CVE-2026-9966HIGH 8.3

  This vulnerability is an integer overflow flaw in how Google Chrome handles XML content on Windows systems. An attacker who has already compromised Chrome's rendering engine could craft a malicious HTML page to escape Chrome's security sandbox—the isolated environment that prevents malicious code from accessing your system directly. The vulnerability requires the attacker to have control of the renderer process first, and it requires user interaction (visiting a malicious page), but if exploited successfully, it could lead to complete system compromise.

• CVE-2026-9970HIGH 8.3

  A use-after-free memory vulnerability exists in Google Chrome's WebGL component that could allow an attacker to escape the browser sandbox. An attacker would first need to compromise Chrome's renderer process—typically through a separate exploit or social engineering—and then could use a specially crafted HTML page to gain unauthorized access outside the browser's security boundaries. This vulnerability affects Chrome versions before 148.0.7778.216 on Windows, macOS, and Linux systems.

• CVE-2026-9972HIGH 8.3

  A vulnerability in Google Chrome on macOS could allow an attacker to escape the browser's security sandbox if the attacker has already compromised Chrome's renderer process. The flaw stems from uninitialized memory in the gamepad handling code. An attacker would need to trick a user into visiting a malicious website while Chrome is running, and would require a prior compromise of the renderer—a critical prerequisite that significantly limits real-world exploitation scenarios. Once exploited, the attacker could potentially gain full system access beyond Chrome's normal restrictions.

• CVE-2026-9974HIGH 8.3

  CVE-2026-9974 is a memory safety bug in Google Chrome's GPU rendering component that can allow an attacker to escape the browser's sandbox if they first compromise the renderer process. The vulnerability stems from an out-of-bounds write operation, meaning the code writes data outside its intended memory boundaries. An attacker would need to trick a user into visiting a malicious webpage while already having control of Chrome's renderer, making this a secondary exploit that amplifies damage from other browser compromises.

• CVE-2026-9975HIGH 8.3

  A memory safety vulnerability in Google Chrome's ANGLE graphics library allows an attacker who has already compromised the browser's renderer process to break out of Chrome's sandbox and gain full system access. The flaw involves reading and writing memory beyond intended boundaries, creating a bridge from the restricted renderer environment to the host operating system. This requires the attacker to first successfully compromise the renderer (through a separate browser exploit or vulnerability) and then craft a malicious HTML page to trigger the escape.

• CVE-2026-9977HIGH 8.3

  A validation flaw in Chrome's WebShare feature on Android allows an attacker who has already compromised Chrome's renderer process to escape the browser sandbox through a specially crafted HTML page. The vulnerability requires the attacker to have gained initial access to the renderer—typically through a separate exploit or compromise—but once inside, the insufficient input checking creates a pathway to break out of the browser's security boundary and potentially gain full device access.

• CVE-2026-9982HIGH 8.3

  CVE-2026-9982 is a sandbox escape vulnerability in Google Chrome's ANGLE graphics library. An attacker who has already compromised the browser's renderer process can exploit insufficient input validation to break out of the sandbox and gain system-level access. This requires an attacker to first deliver a malicious webpage that triggers the rendering flaw, making it a chained attack scenario rather than a one-step exploitation path.

• CVE-2026-9988HIGH 8.3

  A use-after-free memory flaw in Chrome's WebRTC component on Linux could allow an attacker to escape the browser's security sandbox. By crafting a malicious webpage, an attacker who tricks a user into visiting it could potentially break out of Chrome's isolation protections and execute code with system-level privileges. This affects Chrome versions before 148.0.7778.216 on Linux systems.

• CVE-2026-9993HIGH 8.3

  A use-after-free memory vulnerability exists in Google Chrome's rendering engine that allows an attacker to escape the browser's sandbox if they have already compromised the renderer process. The vulnerability is triggered when a user opens a malicious PDF file. This is a critical threat because it could allow an attacker who has gained code execution within the browser to break out of Chrome's security boundaries and gain access to the underlying operating system.

• CVE-2026-9994HIGH 8.3

  A use-after-free vulnerability exists in Google Chrome's core rendering engine on Windows systems. An attacker who has already compromised the browser's renderer process can exploit this flaw through a specially crafted HTML page to escape the browser sandbox—breaking out of Chrome's security isolation layer. This means an attacker could potentially gain full system access from within the constrained renderer environment.

• CVE-2026-9997HIGH 8.3

  Google Chrome versions prior to 148.0.7778.216 contain a use-after-free vulnerability in the Input component that could allow an attacker to escape the browser's sandbox. The attack requires the attacker to have already compromised Chrome's renderer process and trick a user into visiting a malicious HTML page. If successful, the attacker could break out of the sandbox and gain access to the underlying operating system.

• CVE-2026-9998HIGH 8.3

  CVE-2026-9998 is a high-severity integer overflow vulnerability in Google Chrome's Skia graphics library that could allow an attacker to escape the browser's sandbox—a critical security boundary—if they first compromise Chrome's renderer process. The vulnerability requires a specially crafted HTML page and user interaction, making it a significant but not trivial threat. The issue affects Chrome versions before 148.0.7778.216.

• CVE-2016-20062HIGH 8.2

  A SQL injection flaw in the Simply Poll WordPress plugin version 1.4.1 allows attackers without login credentials to steal data directly from a site's database. By crafting malicious requests to the plugin's AJAX handler, an attacker can execute arbitrary database queries and extract sensitive information such as user credentials, posts, or custom data. The vulnerability requires no user interaction and can be exploited by anyone with network access to the affected WordPress site.

• CVE-2016-20065HIGH 8.2

  The Product Catalog 8 plugin version 1.2 for WordPress contains a critical SQL injection flaw that allows attackers to bypass authentication entirely and directly query the WordPress database. An unauthenticated attacker can craft a specially designed POST request to the admin-ajax.php endpoint, manipulating the selectedCategory parameter to inject arbitrary SQL commands. This enables unauthorized data extraction from sensitive WordPress database tables, potentially exposing user credentials, posts, comments, and configuration data without requiring login credentials or user interaction.

• CVE-2016-20068HIGH 8.2

  WordPress Booking Calendar Contact Form version 1.0.23 has a serious security flaw that allows attackers to steal database information without needing to log in. By sending specially crafted requests to the website's admin-ajax.php endpoint, an attacker can inject SQL commands through the 'id' parameter and extract sensitive data like user credentials, customer information, or other database contents. The vulnerability requires no authentication and can be exploited remotely over the network.