By year

Vulnerabilities disclosed in 2026

CVEs published in 2026 with SEC.co analysis.

8541 published vulnerabilities · page 78 of 86

• CVE-2026-13537MEDIUM 4.3

  CodeAstro Human Resource Management System version 1.0 contains a cross-site request forgery (CSRF) vulnerability that allows an attacker to trick users into performing unwanted actions within the HR system. An attacker can craft a malicious link or webpage that, when visited by a logged-in HR employee, silently executes administrative or data-modifying operations on their behalf. The vulnerability affects any network-accessible deployment and exploits have already been disclosed publicly.

• CVE-2026-13554MEDIUM 4.3

  A stored cross-site scripting (XSS) vulnerability exists in itsourcecode Online Hotel Management System version 1.0. An attacker can inject malicious JavaScript code through the amenities management interface that executes in the browsers of other users—specifically administrators—when they view the poisoned data. The vulnerability requires user interaction (clicking a link or viewing a page with the payload) but no authentication to create the malicious input.

• CVE-2026-13556MEDIUM 4.3

  A cross-site scripting (XSS) vulnerability exists in itsourcecode Online Hotel Management System version 1.0. An attacker can inject malicious code through the Name parameter in the user editing interface (/admin/mod_users/controller.php?action=edit), which is then executed in the context of another user's browser. The vulnerability requires user interaction—such as a victim clicking a malicious link—but can cause session hijacking, credential theft, or unauthorized administrative actions. The vulnerability has been publicly disclosed.

• CVE-2026-13557MEDIUM 4.3

  A cross-site scripting (XSS) vulnerability exists in itsourcecode Online Hotel Management System version 1.0. An attacker can inject malicious scripts through the 'Name' parameter in the room management admin interface, which are then reflected back to users who interact with the affected page. This requires user interaction (such as clicking a malicious link) to trigger, but once executed, the injected code runs in the victim's browser with the same privileges as their session.

• CVE-2026-13567MEDIUM 4.3

  A reflected cross-site scripting (XSS) vulnerability has been identified in code-projects Online Music Site version 1.0. The flaw exists in the feedback form handler (/Frontend/Feedback.php) and can be exploited by injecting malicious code into form fields (name, email, address, or message). When a victim visits a malicious link crafted by an attacker, the injected code executes in their browser, potentially allowing credential theft, session hijacking, or malware distribution. Public exploit code is already available, raising the attack likelihood.

• CVE-2026-13837MEDIUM 4.3

  Google Chrome versions prior to 150.0.7871.47 contain a flaw in CSS handling that allows attackers to deceive users through visual spoofing. By crafting a malicious HTML page, an attacker can trick the browser into displaying fake UI elements—such as bogus address bars, dialogs, or buttons—that appear legitimate but are actually part of the webpage content. This could enable phishing attacks or social engineering by making malicious content look like trusted browser or website elements.

• CVE-2026-13842MEDIUM 4.3

  Google Chrome for iOS versions prior to 150.0.7871.47 contain a flaw that allows attackers to trick users by forging what appears in the browser's address bar (Omnibox). An attacker can craft a deceptive HTML page that makes it look like you're visiting a legitimate website when you're actually on a malicious one. This is a spoofing vulnerability—the attacker doesn't gain access to your data or crash your device, but can deceive you about where you actually are on the web.

• CVE-2026-13865MEDIUM 4.3

  Google Chrome versions before 150.0.7871.47 contain a flaw that allows attackers to trick users with fake interface elements. An attacker could craft a malicious website that makes parts of the browser or page look different from what they actually are—for example, spoofing a login prompt or security warning. The vulnerability requires user interaction (visiting a crafted page) but doesn't require special privileges or browser extensions to exploit.

• CVE-2026-13867MEDIUM 4.3

  Google Chrome versions prior to 150.0.7871.47 contain a vulnerability in the Geolocation feature that allows attackers to deceive users through fake UI elements. By crafting a malicious HTML page, a remote attacker can manipulate what users see on screen—a technique known as UI spoofing—without requiring any special system access or authentication. The attack requires user interaction, such as visiting a compromised website, but does not result in data theft or system compromise.

• CVE-2026-13902MEDIUM 4.3

  A flaw in Google Chrome for iOS allows an attacker to trick users by making fake content appear in the browser UI. An attacker would need to craft a malicious webpage and convince a user to visit it; the browser would then display misleading interface elements that could be mistaken for genuine browser controls or trusted content. This is a medium-severity issue that affects user trust and could enable phishing or social engineering attacks.

• CVE-2026-13912MEDIUM 4.3

  Google Chrome on iOS versions before 150.0.7871.47 contain a flaw in how the Safe Browsing feature validates and displays security information. An attacker can craft a malicious web page that tricks users by spoofing the browser's user interface—making it appear as though Chrome is displaying legitimate security warnings or information when it is not. This deceives users into taking actions they would not normally take, such as entering credentials or downloading files. The vulnerability requires user interaction (visiting the malicious page) to be exploited.

• CVE-2026-13916MEDIUM 4.3

  A vulnerability in Chrome for iOS allows an attacker to trick users into believing they are seeing legitimate content or UI elements when they are actually viewing a forged interface. An attacker would craft a specially designed web page and serve it to a user; if the user visits the page, the attacker could spoof the browser's user interface—for example, making a phishing page look like a legitimate login screen. This affects Chrome versions prior to 150.0.7871.47 on iOS devices. The attack requires user interaction (visiting the malicious page) but no special permissions or system access.

• CVE-2026-13941MEDIUM 4.3

  Google Chrome on Android contains a flaw in how it handles SiteSettings that allows attackers to deceive users visually through a specially crafted web page. An attacker can craft HTML that tricks Chrome's interface into displaying misleading information to the user—for example, making it appear that a dangerous permission has been denied when it was actually granted, or vice versa. This is a social engineering vector that relies on user interaction (visiting the malicious page) but does not require special browser permissions or system privileges to execute.

• CVE-2026-13946MEDIUM 4.3

  A security flaw in Google Chrome on iOS allows attackers to steal data from different websites by tricking users into viewing a specially crafted webpage. The vulnerability stems from improper handling of script injections, which can expose information that should remain hidden between websites. An attacker needs user interaction—typically clicking a link or visiting a malicious site—to exploit this, making it a moderate rather than critical risk.

• CVE-2026-13952MEDIUM 4.3

  A flaw in Google Chrome's PerformanceAPIs allows attackers to steal data from different websites without proper authorization. An attacker can craft a malicious webpage that, when visited by a user, reads sensitive information from other sites the user has open. The vulnerability requires user interaction—the victim must visit the attacker's page—but no special browser settings or advanced technical knowledge are needed to exploit it. Google has patched this issue in Chrome version 150.0.7871.47 and later.

• CVE-2026-13959MEDIUM 4.3

  Google Chrome versions before 150.0.7871.47 contain a flaw in Blink (Chrome's rendering engine) that fails to properly validate user input in HTML pages. An attacker can exploit this by crafting a malicious HTML page that, when visited, bypasses the same-origin policy—a critical browser security boundary that prevents websites from accessing data or performing actions on behalf of other sites. The vulnerability requires user interaction (visiting a malicious page) but poses a moderate integrity risk.

• CVE-2026-13960MEDIUM 4.3

  Google Chrome versions before 150.0.7871.47 contain a flaw in the password management system that allows attackers to deceive users through visual trickery. By crafting a malicious web page, an attacker can make Chrome's interface appear to show something it isn't—for example, a legitimate password prompt or security warning—fooling users into taking actions they wouldn't normally take. This is a UI spoofing attack: the attacker doesn't break into systems directly, but manipulates what users see on screen to trick them into compromising their own credentials or security.

• CVE-2026-13966MEDIUM 4.3

  Google Chrome contains a flaw in how it handles browser history that allows an attacker to trick users into believing they are viewing legitimate content when they are not. An attacker can craft a malicious webpage that, when visited, spoofs the appearance of the browser's UI—such as the address bar or other interface elements—to deceive users about what site they are actually on or what action they are performing. This requires user interaction (clicking or viewing the page) but does not require any special system privileges. The issue affects Chrome versions before 150.0.7871.47.

• CVE-2026-13972MEDIUM 4.3

  Google Chrome versions before 150.0.7871.47 contain a flaw in how the browser's Paint component handles HTML rendering that allows attackers to trick users into thinking they're interacting with legitimate interface elements when they're actually viewing spoofed content. An attacker could craft a malicious webpage that, when visited, displays fake buttons, address bars, or other UI elements to deceive users into performing unintended actions. The attack requires user interaction—specifically visiting the malicious page—but no special privileges or difficult technical conditions.

• CVE-2026-13978MEDIUM 4.3

  Google Chrome versions before 150.0.7871.47 contain a vulnerability in how the browser enforces policies within its PageInfo component, which displays website permission and security information to users. An attacker can craft a malicious HTML page that tricks users into believing they are interacting with legitimate Chrome UI elements—such as permission prompts or security warnings—when they are actually seeing attacker-controlled content. This UI spoofing attack requires user interaction to succeed but could lead to credential theft, social engineering, or other deceptive practices if the fake UI is convincing enough.

• CVE-2026-13979MEDIUM 4.3

  Google Chrome versions before 150.0.7871.47 contain a UI spoofing vulnerability in the Paint feature. An attacker can craft a malicious HTML page that, when visited by a user, tricks the browser into displaying misleading visual elements—making it appear that legitimate security warnings or interface elements are present when they are not. This is a client-side attack requiring user interaction but poses a real risk of social engineering and credential theft.

• CVE-2026-13980MEDIUM 4.3

  Google Chrome for iOS versions before 150.0.7871.47 contain a flaw that allows attackers to trick users through misleading user interface elements. An attacker could craft a malicious webpage that, when visited, displays fake Chrome UI components—such as address bars or security indicators—to deceive users into believing they're interacting with legitimate browser elements. This is a spoofing vulnerability that relies on user interaction; attackers must convince someone to visit a crafted page, but no special user permissions or technical sophistication is required on the user's end.

• CVE-2026-13981MEDIUM 4.3

  Google Chrome on iOS contains a UI spoofing vulnerability that allows attackers to deceive users by manipulating how the browser interface appears. An attacker can craft a malicious HTML page that, when visited, tricks users into believing they're interacting with legitimate UI elements—such as address bars or security warnings—when they're actually viewing attacker-controlled content. This vulnerability requires user interaction (visiting the malicious page) but does not compromise data confidentiality or system availability.

• CVE-2026-13984MEDIUM 4.3

  Google Chrome versions before 150.0.7871.47 contain a flaw in the TabStrip component's security interface that allows an attacker to deceive users through visual spoofing. By crafting a malicious web page, an attacker can manipulate what the browser displays to make it appear legitimate while performing unwanted actions. The attack requires user interaction—specifically, the user must visit the malicious page—but does not require any special privileges or complex browser configurations to execute.

• CVE-2026-13987MEDIUM 4.3

  A vulnerability in Google Chrome on Android allows attackers to deceive users through fake security warnings or misleading interface elements. By crafting a malicious HTML page, a remote attacker can make Chrome's security UI appear different from what it actually is—for example, displaying a fake warning dialog or masking the real address bar—to trick users into trusting untrustworthy content or performing unintended actions. The attack requires user interaction (clicking or viewing the page) but no special privileges. This affects Chrome versions prior to 150.0.7871.47 on Android devices.

• CVE-2026-13991MEDIUM 4.3

  A vulnerability in Chrome for iOS allows attackers to trick users through fake interface elements on specially crafted websites. When a user visits a malicious page, an attacker can make it appear as though legitimate interface elements (like buttons or address bars) are showing something they're not, potentially tricking the user into taking unintended actions. This requires user interaction—the user must visit the malicious site and interact with it—but the barrier to exploitation is low.

• CVE-2026-13994MEDIUM 4.3

  Google Chrome on Android contains a flaw in how it manages user credentials that allows attackers to trick users with fake authentication dialogs or credential prompts. An attacker hosting a specially crafted website could deceive users into believing they're interacting with legitimate Chrome security features, potentially leading to credential theft or other user manipulation. The vulnerability requires user interaction—specifically visiting a malicious webpage—but poses a real risk because users generally trust browser UI elements.

• CVE-2026-13995MEDIUM 4.3

  A flaw in Google Chrome's autofill feature on Android devices allows an attacker to trick users with a fake website. The vulnerability exists because the browser doesn't properly validate input when displaying autofill suggestions, giving attackers an opening to create deceptive pages that mimic legitimate interfaces. This is a relatively low-risk issue—it requires user interaction and only affects how information appears on screen, not data theft or system crashes—but it's worth patching because social engineering attacks that fool users into revealing credentials remain a persistent threat.

• CVE-2026-13999MEDIUM 4.3

  Google Chrome versions before 150.0.7871.47 contain a flaw that allows malicious browser extensions to trick users visually by displaying fake UI elements. An attacker must first convince a user to install a malicious extension, but once installed, the extension can spoof Chrome's user interface to deceive the user. This is classified as a medium-severity issue because it requires user interaction to install the extension and doesn't directly compromise system data or functionality on its own.

• CVE-2026-14003MEDIUM 4.3

  A flaw in how Google Chrome enforces security policies for extensions allows a malicious extension to access and leak data from websites you visit across different origins—essentially reading information it shouldn't have access to. An attacker would need to trick you into installing a malicious extension first, but once installed, the extension can quietly exfiltrate sensitive cross-origin data without additional user interaction. This affects Chrome versions before 150.0.7871.47.

• CVE-2026-14013MEDIUM 4.3

  Google Chrome versions before 150.0.7871.47 contain a flaw in how SVG (Scalable Vector Graphics) content is handled that allows attackers to trick users through misleading visual elements on a web page. An attacker would need to host a specially crafted HTML page and convince a user to visit it; once there, the vulnerability could be exploited to display fake UI elements—such as fake login prompts or warning dialogs—that appear to come from Chrome or a trusted application. This is primarily a user-trust issue rather than a direct system compromise.

• CVE-2026-14020MEDIUM 4.3

  A flaw in Google Chrome's WebXR implementation allows a remote attacker to trick users into thinking they're interacting with legitimate interface elements when they're actually engaging with spoofed content. The vulnerability requires the attacker to first compromise Chrome's renderer process—the component that draws web pages—and then serve a malicious webpage to execute the UI spoofing attack. While the initial compromise is a prerequisite, once achieved, users can be deceived without additional interaction beyond normal web browsing.

• CVE-2026-14031MEDIUM 4.3

  Google Chrome versions prior to 150.0.7871.47 contain a flaw in how the file input component handles user interactions, enabling attackers to deceive users through visual spoofing attacks. A malicious HTML page can trick users into believing they are interacting with legitimate browser UI elements when they are not, potentially leading to unintended actions or credential harvesting through deceptive interface overlays.

• CVE-2026-14034MEDIUM 4.3

  CVE-2026-14034 is a navigation-bypass vulnerability in Google Chrome's WebXR implementation on Android. An attacker can craft a malicious HTML page that, when visited by a user, circumvents browser navigation restrictions. While the underlying Chromium severity is rated Low, the CVSS score of 4.3 reflects the requirement for user interaction and limited direct impact. The vulnerability does not enable data theft or system crashes but does allow unauthorized page navigation, which could facilitate phishing or redirect attacks.

• CVE-2026-14039MEDIUM 4.3

  CVE-2026-14039 is a same-origin policy bypass vulnerability in Google Chrome's GetUserMedia implementation. An attacker could craft a malicious HTML page to trick users into visiting it, bypassing browser protections that normally prevent one website from accessing resources or data from another website. The vulnerability affects Chrome versions before 150.0.7871.47 and requires user interaction to exploit. While Google rates it as low severity internally, the CVSS score of 4.3 reflects the integrity impact and low attack complexity.

• CVE-2026-14042MEDIUM 4.3

  A vulnerability in Google Chrome's Isolated Web Apps feature allows attackers to deceive users through visual manipulation. By sending a specially crafted HTML page, an attacker can spoof the browser's user interface—for example, making a fake login prompt or warning appear legitimate. The attacker cannot steal data or crash the browser, but can trick users into performing actions they wouldn't normally take. This affects Chrome versions before 150.0.7871.47.

• CVE-2026-14045MEDIUM 4.3

  A flaw in Google Chrome's network handling allows attackers who have already compromised the browser's renderer process to steal sensitive data from websites the user visits. The attacker would craft a malicious webpage designed to leak information across security boundaries that normally keep data from different websites separate. This requires the attacker to have already gained control of Chrome's rendering engine, making this a post-compromise issue rather than a remote code execution vector.

• CVE-2026-14046MEDIUM 4.3

  A flaw in Google Chrome's CustomTabs implementation on Android allows an attacker to circumvent the same-origin policy—a fundamental browser security boundary—by crafting a malicious HTML page. While Chromium rated this as low severity, the CVSS assessment reflects a medium risk because user interaction is required to exploit it, but the integrity impact (unauthorized modification of content or state) is real. The vulnerability affects Chrome versions prior to 150.0.7871.47 on Android devices.

• CVE-2026-14047MEDIUM 4.3

  A vulnerability in Google Chrome's extension system allows a malicious extension to bypass the browser's content security policy (CSP), a critical security boundary designed to prevent injection attacks. An attacker would need to trick a user into installing the malicious extension first, but once installed, the extension could inject or modify content in ways that CSP normally blocks. This affects Chrome versions before 150.0.7871.47.

• CVE-2026-14052MEDIUM 4.3

  Google Chrome versions before 150.0.7871.47 contain a flaw that allows attackers to bypass file system access restrictions through a specially crafted web page. An attacker would need to trick a user into visiting a malicious site, but once there, the vulnerability could allow unauthorized file operations that would normally be blocked by the browser's security policies.

• CVE-2026-14053MEDIUM 4.3

  A vulnerability in Google Chrome's extension policy enforcement allowed attackers who had already compromised Chrome's renderer process to steal data from websites a user was visiting, bypassing the normal cross-origin protections that keep data private between sites. The flaw required an attacker to first gain control of Chrome's rendering engine—a significant prerequisite—and then trick a user into visiting a malicious webpage. This is a localized threat that affects only users whose Chrome instances have been compromised at a deep level.

• CVE-2026-14054MEDIUM 4.3

  Google Chrome versions prior to 150.0.7871.47 contain a flaw in how the browser enforces navigation policies. An attacker can craft a malicious HTML page that, when visited by a user, bypasses restrictions meant to control where the browser can navigate. While the underlying vulnerability is rated Low by Chromium's own assessment, it does carry integrity risk—an attacker could potentially redirect users to unintended pages or manipulate the browser's navigation behavior in ways that undermine trust in the browser's security model.

• CVE-2026-14057MEDIUM 4.3

  A vulnerability in Google Chrome's Federated Credential Management (FedCM) implementation allows attackers to bypass the same-origin policy—a fundamental browser security boundary that prevents malicious websites from accessing data belonging to other sites. An attacker could craft a deceptive HTML page to trick users into visiting it, potentially enabling unauthorized access to credentials or identity information. The vulnerability affects Chrome versions before 150.0.7871.47 and requires user interaction to exploit.

• CVE-2026-14058MEDIUM 4.3

  Google Chrome versions before 150.0.7871.47 contain a policy enforcement gap in its HTML parser that allows remote attackers to circumvent Content Security Policy (CSP) protections. An attacker can craft a malicious HTML page that, when visited by a user, bypasses CSP restrictions that would normally prevent inline scripts, external resource loading, or other potentially dangerous content execution. This is a client-side vulnerability requiring user interaction—a victim must visit the attacker's page for the bypass to occur.

• CVE-2026-14066MEDIUM 4.3

  A vulnerability in Google Chrome for iOS allows attackers to bypass navigation restrictions through a specially crafted webpage. An attacker could create a malicious HTML page that, when visited by a user, circumvents Chrome's security controls that normally prevent unwanted navigation. This requires user interaction—the user must visit the malicious page—but does not require the attacker to have special privileges. The impact is limited to integrity concerns rather than data theft or system disruption.

• CVE-2026-14072MEDIUM 4.3

  Google Chrome contains a flaw in how it implements the SplitView feature that allows attackers to trick users by making malicious web content appear as legitimate browser UI elements. An attacker hosting a specially crafted web page can exploit this to perform UI spoofing—essentially overlaying fake buttons, address bars, or other interface elements—potentially deceiving users into taking actions they didn't intend. The vulnerability requires user interaction (visiting a malicious site) to exploit and does not allow data theft or system crashes, but the deception risk is real enough to warrant attention.

• CVE-2026-14073MEDIUM 4.3

  A flaw in Google Chrome's WebXR implementation fails to properly validate user-supplied input before processing navigation commands. An attacker can craft a malicious webpage that, when visited by a user, bypasses Chrome's navigation restrictions—allowing the page to navigate to unexpected URLs or perform unwanted redirects. The vulnerability requires user interaction (clicking or visiting the page) and affects Chrome versions prior to 150.0.7871.47. The issue stems from insufficient input sanitization in the WebXR code path, a component used for virtual and augmented reality experiences in the browser.

• CVE-2026-14075MEDIUM 4.3

  A vulnerability in Chrome for iOS allows attackers to send HTTP requests with referrer information even when a web page has explicitly set a no-referrer policy. An attacker crafts a malicious HTML page that tricks the browser into ignoring this privacy protection, potentially leaking information about which website a user came from. This is a client-side bypass that requires user interaction—the user must visit the attacker's page—but could expose browsing patterns or sensitive context depending on the websites involved.

• CVE-2026-14076MEDIUM 4.3

  Google Chrome versions before 150.0.7871.47 contain a weakness in how the browser enforces Content Security Policy (CSP), a security feature that restricts which resources a webpage can load. An attacker could craft a malicious HTML page that tricks the browser into loading content that should have been blocked by CSP rules, potentially allowing injection of unwanted scripts or other resources. The attack requires user interaction—the victim must visit the malicious page—but succeeds against unpatched Chrome installations on Windows, macOS, and Linux.

• CVE-2026-14077MEDIUM 4.3

  Google Chrome on macOS contains a flaw in how it handles the Select element that allows attackers to trick users by making the browser's address bar (Omnibox) display fake URLs. An attacker would craft a malicious webpage that, when visited, could make it appear that the user is on a legitimate site when they're actually somewhere else. This is a spoofing vulnerability that relies on user interaction—the victim must visit the malicious page—but requires no special privileges to exploit.

• CVE-2026-14079MEDIUM 4.3

  Google Chrome versions before 150.0.7871.47 contain a policy enforcement weakness that allows an attacker to bypass the same-origin policy—a core browser security boundary designed to prevent malicious websites from stealing data from legitimate ones. An attacker would need to trick a user into visiting a specially crafted webpage to exploit this flaw. Once successful, the attacker could manipulate or access content from other origins in ways the browser normally forbids, potentially enabling credential theft, session hijacking, or unauthorized access to sensitive user data across multiple websites.

• CVE-2026-14080MEDIUM 4.3

  Google Chrome on Android versions before 150.0.7871.47 contain a flaw in the TabSwitcher component that fails to properly validate untrusted network data. An attacker can exploit this to bypass navigation restrictions—essentially forcing users to visit pages they shouldn't be able to reach—by sending specially crafted network traffic. The vulnerability requires user interaction (clicking or tapping) to trigger, but doesn't compromise data confidentiality or system availability.

• CVE-2026-14089MEDIUM 4.3

  A flaw in Google Chrome's popup blocker allowed an attacker who had already gained control of Chrome's renderer process to trick users into seeing fake interface elements. The vulnerability stems from inadequate checking of user-supplied input, making it possible to craft a malicious webpage that displays spoofed UI when opened in the compromised renderer. This is a low-severity issue on Chromium's scale, though the CVSS rating reflects medium risk due to the user interaction required and limited scope of impact.

• CVE-2026-14092MEDIUM 4.3

  Google Chrome versions before 150.0.7871.47 contain a privacy flaw that allows attackers positioned on a network path between a user and servers to intercept and expose data that should remain isolated between different websites. An attacker must trick or socially engineer the user into visiting a malicious page, but once that happens, the browser's normal cross-origin protections can be bypassed through crafted network traffic. The issue affects Chrome on Windows, macOS, and Linux.

• CVE-2026-14105MEDIUM 4.3

  Google Chrome versions before 150.0.7871.47 contain a flaw in how the Speech API enforces origin policies. An attacker can craft a malicious web page that tricks the browser into allowing cross-origin access to speech functionality when it shouldn't. While the browser's Chromium team rated this as low severity, the impact is integrity-focused—an attacker could manipulate speech data or interactions across origin boundaries, potentially affecting users of web applications that rely on the Speech API.

• CVE-2026-14110MEDIUM 4.3

  Google Chrome versions before 150.0.7871.47 contain a vulnerability in the Dark Mode feature that allows an attacker to deceive users through crafted web pages. By manipulating how Dark Mode renders interface elements, an attacker could trick users into believing they are interacting with legitimate browser controls or content when they are not. This is a client-side UI spoofing vulnerability that requires user interaction to exploit.

• CVE-2026-14116MEDIUM 4.3

  Google Chrome versions before 150.0.7871.47 contain a vulnerability in the Developer Tools (DevTools) feature that can expose sensitive data across different websites. The flaw occurs because Chrome fails to properly validate user input within DevTools. An attacker can craft a malicious webpage that, if a user interacts with it in a specific way while DevTools is active, could leak information that should remain isolated between different websites. This is a user-interaction attack—the victim must perform deliberate actions for the vulnerability to be exploited.

• CVE-2026-14123MEDIUM 4.3

  Chrome on iOS versions before 150.0.7871.47 contain a flaw in how the browser's address bar (Omnibox) displays security information. An attacker can craft a malicious webpage that tricks the browser into showing a fake URL in the address bar, making it appear as though you're visiting a legitimate site when you're actually on an attacker's domain. This is a spoofing vulnerability that exploits the visual trust signals users rely on to verify they're on the correct website.

• CVE-2026-14126MEDIUM 4.3

  Google Chrome on Android has a flaw in how it displays security information to users. An attacker could create a malicious webpage that tricks users into thinking they're visiting a legitimate website when they're actually on the attacker's site. This happens because Chrome isn't properly validating or displaying domain information in certain scenarios. The vulnerability requires user interaction—specifically clicking a link or visiting a crafted page—but doesn't directly expose sensitive data or break the browser's core security model.

• CVE-2026-14127MEDIUM 4.3

  Google Chrome versions prior to 150.0.7871.47 contain a flaw in how the browser handles printing functionality that could allow an attacker to trick users into believing they are interacting with legitimate content when they are not. The vulnerability requires the attacker to have first compromised the Chrome renderer process—the sandboxed component responsible for displaying web content—and then use a specially crafted webpage to create a fake or misleading user interface. While the underlying issue is classified as low severity by the Chromium project, the CVSS scoring reflects the user interaction required and the limited scope of potential impact.

• CVE-2026-14128MEDIUM 4.3

  A flaw in Google Chrome for iOS allows attackers to trick users by making the browser's address bar (Omnibox) display a fake URL. An attacker would craft a malicious web page and trick a user into visiting it; when the user views the address bar, they see a spoofed URL instead of the actual malicious site they're on. This leverages a user interaction requirement—the victim must actively look at the URL bar—which limits the immediate risk, but the deception could enable phishing or social engineering attacks.

• CVE-2026-14130MEDIUM 4.3

  Google Chrome versions before 150.0.7871.47 contain a flaw in the browser's address bar (Omnibox) security indicators that allows an attacker to deceive users through visual spoofing. When a user visits a malicious webpage, the attacker can craft HTML content that makes the browser's security UI display false information—such as misleading indicators about the site's legitimacy or HTTPS status. The vulnerability requires user interaction (visiting the crafted page) but does not directly compromise data confidentiality or system availability; the primary risk is user deception leading to credential theft or other social engineering attacks.

• CVE-2026-14134MEDIUM 4.3

  Google Chrome on Android has a flaw in its Autofill feature that allows an attacker to trick users with fake interface elements on a malicious webpage. An attacker could craft a page that mimics Chrome's autofill UI to deceive users into entering or confirming sensitive information, but the attack requires user interaction and is limited to Android devices running Chrome versions before 150.0.7871.47. The vulnerability does not involve data theft or system crashes, but focuses on visual deception.

• CVE-2026-14136MEDIUM 4.3

  Google Chrome on iOS versions before 150.0.7871.47 contain a UI spoofing vulnerability that allows attackers to deceive users through a crafted web page. The vulnerability stems from inadequate input validation, enabling malicious actors to manipulate the browser interface in ways that mislead users about the actual content or origin of what they're viewing. While the underlying severity is rated Low by Chromium, the CVSS score of 4.3 reflects the human interaction requirement and limited direct impact—this is primarily a social engineering vector rather than a system compromise threat.

• CVE-2026-14140MEDIUM 4.3

  Google Chrome on Android versions before 150.0.7871.47 contains a vulnerability that allows attackers to deceive users through fake interface elements. An attacker can craft a malicious web page that, when visited, displays misleading UI elements—such as fake prompts, buttons, or address bars—to trick users into performing unintended actions. The vulnerability stems from insufficient validation of user-supplied input and does not require the attacker to have any special privileges or access. However, the user must actively visit a malicious page and interact with it for the attack to succeed.

• CVE-2026-14141MEDIUM 4.3

  Google Chrome on Android has a flaw in how it displays security information when using the Document Picture-in-Picture feature. An attacker can craft a webpage that tricks users into believing they're visiting a legitimate website when they're actually on a malicious one. This happens because the security indicator that normally shows you the real domain being visited can be hidden or spoofed. The vulnerability affects Chrome versions before 150.0.7871.47 on Android devices.

• CVE-2026-14143MEDIUM 4.3

  Google Chrome on iOS contains a flaw in how it displays password-related security warnings and UI elements. An attacker can craft a malicious webpage that tricks users into thinking they're interacting with legitimate Chrome security prompts when they're actually viewing attacker-controlled content. This UI spoofing could lead users to enter sensitive information or bypass security checks they would otherwise trust. The vulnerability affects Chrome versions before 150.0.7871.47 on Apple iOS devices.

• CVE-2026-14209MEDIUM 4.3

  Keycloak's Admin UI has a permission-bypass flaw in its fine-grained access control system. An administrator restricted to searching for users—without permission to view their full profiles—can exploit a specific search endpoint to retrieve complete user details, including sensitive metadata. The system fails to enforce view-level permissions on this particular code path, creating an unauthorized information disclosure risk for privileged but constrained accounts.

• CVE-2026-14410MEDIUM 4.3

  A flaw in Google Chrome's Skia graphics library (versions before 150.0.7871.46) allows an attacker who has already compromised the browser's rendering engine to trick users with fake UI elements. The attacker crafts a malicious webpage that, once loaded in an already-compromised renderer, displays spoofed interface components—such as fake address bars or security warnings—to deceive users into taking unwanted actions. The attack requires the renderer process to be compromised first, meaning this is a secondary exploitation technique rather than a standalone attack vector.

• CVE-2026-14418MEDIUM 4.3

  A vulnerability in Google Chrome's ANGLE graphics library prior to version 150.0.7871.46 could allow an attacker to leak data from other websites if a user visits a malicious page. The issue stems from uninitialized memory being processed in a way that exposes cross-origin information. While the CVSS score is moderate (4.3), the Chromium team rated it as High severity due to the nature of cross-origin data exposure. An attacker would need to trick a user into visiting a crafted HTML page, but no special privileges are required.

• CVE-2026-14608MEDIUM 4.3

  A vulnerability in SourceCodester CET Automated Grading System with AI Predictive Analytics version 1.0 allows authenticated users to bypass authorization controls by manipulating an ID parameter in POST requests to /index.php?action=view_student. An attacker with valid login credentials can access student records they should not be permitted to view. The vulnerability has been publicly disclosed and exploit code may be available.

• CVE-2026-14611MEDIUM 4.3

  DeepMyst Mysti versions up to 0.4.0 contain a flaw in the Per-Project Auto-Memory Handler that allows an authenticated attacker to access sensitive resource information by manipulating the workspace path argument passed to the memory initialization function. The vulnerability requires valid user credentials and network access but does not enable modifications or service disruption.

• CVE-2026-14613MEDIUM 4.3

  Keycloak's administrative interface contains an authorization flaw in its Fine-Grained Admin Permissions v2 system. When this feature is enabled, administrators granted permission to view specific roles can inadvertently see all groups linked to those roles, regardless of whether they have been granted access to those groups. This bypasses intended access controls and exposes group information—including internal identifiers and custom configurations—to administrators who should be restricted from viewing it. The vulnerability requires administrative credentials to exploit, limiting immediate risk, but undermines the security model for organizations using Keycloak to enforce role-based administrative separation.

• CVE-2026-14615MEDIUM 4.3

  A flaw in Keycloak's Fine-Grained Admin Permissions (FGAP) v2 feature allows delegated administrators to view details of child groups they shouldn't have access to. When a delegated admin queries a parent group, the system fails to properly check permissions before revealing information about nested groups—including names, paths, and custom attributes. While this doesn't grant the ability to modify data or crash the system, it represents an unintended information disclosure that could aid attackers in reconnaissance or help malicious insiders map organizational structure.

• CVE-2026-14618MEDIUM 4.3

  A denial-of-service vulnerability exists in Open5GS, an open-source 5G core network implementation, affecting versions up to 2.7.7. The flaw resides in the AMF (Access and Mobility Management Function) component's handler for network function discovery. A remote attacker with valid credentials can trigger a condition that crashes or degrades the availability of the affected AMF service. Public exploit code is available, elevating the practical risk despite the moderate CVSS score.

• CVE-2026-14623MEDIUM 4.3

  A vulnerability in the OMEC Project AMF (Access and Mobility Management Function) component allows authenticated attackers to trigger a denial-of-service condition by manipulating NGAP (NG Application Protocol) messages, specifically those handled by the RRCInactiveTransitionReport function. An attacker with valid network credentials can send crafted messages that destabilize the AMF service, affecting call setup and user mobility. The issue affects versions up to 2.1.1, and exploit code has already been made public.

• CVE-2026-14624MEDIUM 4.3

  A denial-of-service vulnerability exists in the OMEC-project AMF (Access and Mobility Management Function) component affecting versions up to 2.0.2 and 2.1.1. The flaw resides in how the NGSetupRequest handler processes incoming requests, allowing an authenticated attacker to trigger a service disruption. The vulnerability requires user credentials to exploit but can be triggered over the network without user interaction, making it a concern for deployments where internal network access is available to untrusted parties.

• CVE-2026-14626MEDIUM 4.3

  NousResearch's hermes-agent product contains a flaw in its HTTP API that allows authenticated users to trigger a denial of service condition. By manipulating a specific input parameter called 'todos' in the conversation function, an attacker can crash or hang the service, making it unavailable to legitimate users. The vulnerability affects versions up to 2026.4.30 and requires login credentials to exploit, limiting its blast radius to environments where attacker access is already possible.

• CVE-2026-14629MEDIUM 4.3

  RT-Thread versions up to 5.2.2 contain a flaw in the parameter handling system that can crash the service. An authenticated attacker can manipulate certain system operations to trigger a divide-by-zero error, causing a denial of service. Because the flaw requires existing user access and does not enable data theft or unauthorized access, the impact is limited to availability.

• CVE-2026-14632MEDIUM 4.3

  An open redirect vulnerability has been discovered in kirilkirkov's Ecommerce-CodeIgniter-Bootstrap project. The vulnerability exists in the setReferrer function of the backend controller interface, where user-controlled redirect parameters are not properly validated. An attacker can craft a malicious link that appears legitimate but redirects users to an external website after they interact with the application. While this requires user interaction and does not directly compromise the affected system, it can be leveraged in phishing campaigns or to redirect authenticated users to malicious sites. The vendor has released a patch that should be deployed promptly.

• CVE-2026-14633MEDIUM 4.3

  A cross-site scripting (XSS) vulnerability exists in the Ecommerce-CodeIgniter-Bootstrap project's hidden REST API endpoint at /index.php/api/product/set. An attacker can inject malicious scripts via the title or description parameters, which are then reflected back to users. This requires a user to interact with a crafted link or request, but once exploited, it allows arbitrary JavaScript execution in the victim's browser context. The vulnerability has been publicly disclosed, and the affected codebase uses a rolling release model, meaning patch deployment is version-agnostic.

• CVE-2026-14634MEDIUM 4.3

  A cross-site scripting (XSS) vulnerability exists in the Ecommerce-CodeIgniter-Bootstrap project affecting the Subscribed Emails Admin Page. An attacker can manipulate the User-Agent header to inject malicious scripts that execute in the context of an administrator's browser session. The vulnerability requires user interaction (an admin must visit a page with the malicious header present) and does not allow unauthorized data access or system availability impact, but could enable account compromise or administrative action abuse. Proof-of-concept code is publicly available, elevating the practical risk despite the CVSS medium rating.

• CVE-2026-14647MEDIUM 4.3

  A flaw in ONNX Runtime versions up to 1.21.x allows an authenticated attacker to read memory beyond intended boundaries when processing certain neural network model operations. An attacker with login credentials can send a specially crafted model file to trigger an out-of-bounds read, potentially exposing sensitive data. The vulnerability resides in shape inference logic for pooling operations and can be exploited remotely without user interaction.

• CVE-2026-14656MEDIUM 4.3

  A stored or reflected cross-site scripting (XSS) vulnerability exists in code-projects Assessment Management version 1.0, specifically in the user removal functionality at /admin/remove-user.php. An attacker can inject malicious JavaScript through the ID parameter, which executes in the browser of any admin who clicks a crafted link. This does not require the attacker to authenticate, but does require user interaction—typically clicking a malicious link. The vulnerability has been publicly disclosed, increasing exposure risk.

• CVE-2026-14704MEDIUM 4.3

  A cross-site scripting (XSS) vulnerability exists in stephen-kruger bluebox through version 4.5.12. An attacker can manipulate the 'code' argument to inject malicious scripts that execute in a victim's browser. The attack requires user interaction (such as clicking a link) but can be launched remotely. Public exploits are available, increasing the risk of active exploitation.

• CVE-2026-14783MEDIUM 4.3

  NousResearch's hermes-agent version 2026.5.29.2 contains a path traversal vulnerability in its skills tool. An authenticated attacker can manipulate the 'Name' argument to the skill_view function, allowing them to read files outside the intended directory. The vulnerability requires valid credentials but can be exploited remotely. A patch is available and should be applied promptly.

• CVE-2026-14793MEDIUM 4.3

  Craft CMS versions up to 4.18.0.1 contain an authorization bypass vulnerability in the global sets reordering functionality. An authenticated attacker can manipulate requests to the reorder-sets endpoint to perform actions they should not be authorized to perform. The vulnerability requires valid user credentials but does not require any special privileges or user interaction. Upgrading to version 4.18.1 eliminates the issue.

• CVE-2026-14794MEDIUM 4.3

  Craft CMS versions up to 4.18.0.1 contain an authorization bypass in the Charts Endpoint. An authenticated user can manipulate the userGroupId parameter in the actionGetNewUsersData function to access data they should not be permitted to view. The vulnerability requires an active login but allows remote exploitation with no further user interaction needed. Craft CMS 4.18.1 and later patch this issue.

• CVE-2026-14800MEDIUM 4.3

  A cross-site request forgery (CSRF) flaw has been discovered in imhamzaazam ecommerceFlask, an open-source e-commerce framework. The vulnerability allows an attacker to trick authenticated users into performing unintended actions—such as modifying orders, changing account settings, or making purchases—without their knowledge. The flaw resides in an unspecified function and requires user interaction (clicking a malicious link or visiting a compromised site) to exploit. Public exploit code is available, elevating the practical risk of opportunistic attacks.

• CVE-2026-15026MEDIUM 4.3

  A WordPress plugin called 'Import and export users and customers' exposes sensitive post content to low-privilege attackers. Any authenticated user, even with basic subscriber access, can read the full text and titles of any post on the site—including drafts, private posts, password-protected content, and data from non-public areas like WooCommerce orders or internal CRM records—by simply guessing post IDs. The vulnerability exists because a security token is carelessly exposed in page source code, and the plugin fails to properly restrict access to sensitive data retrieval functions.

• CVE-2026-15034MEDIUM 4.3

  A cross-site request forgery (CSRF) vulnerability exists in Flask-MonitoringDashboard versions up to 5.0.2. An attacker can craft a malicious web page that, when visited by an authenticated user, performs unwanted actions within the dashboard without the user's knowledge or consent. The vulnerability requires user interaction—the victim must visit the attacker's page while logged into the dashboard—but no special privileges are needed to exploit it. Public disclosure has already occurred, increasing the risk of active exploitation.

• CVE-2026-15036MEDIUM 4.3

  Harness versions up to 2.28.2 contain an authorization bypass vulnerability in the gitspaces endpoint that allows authenticated users to access workspace data they should not be able to see. An attacker with valid Harness credentials can manipulate requests to the getAuthorizedSpaces function to view information about spaces belonging to other users or teams. This is a remote attack requiring only network access and valid login credentials. Public exploit details are available, increasing the practical risk.

• CVE-2026-15108MEDIUM 4.3

  Google Chrome contains an integer overflow vulnerability in its Extensions API that could allow an attacker to read memory outside intended bounds. The vulnerability requires social engineering—an attacker must convince a user to install a malicious extension. Once installed, the crafted extension can exploit the flaw to access sensitive data from Chrome's memory. This is a client-side attack with medium severity, as successful exploitation depends on user interaction and results in information disclosure rather than code execution.

• CVE-2026-15124MEDIUM 4.3

  Google Chrome versions before 150.0.7871.115 contain a weakness in how the browser enforces the same-origin policy, a critical security boundary that prevents websites from accessing data belonging to other websites. An attacker can craft a malicious HTML page that, when visited by a user, exploits this weakness to read sensitive information—such as passwords or authentication tokens—from other websites you're logged into. The attack requires user interaction (visiting the malicious page) but doesn't need any special privileges or complex technical setup.

• CVE-2026-15130MEDIUM 4.3

  Google Chrome versions before 150.0.7871.115 contain a flaw in how the browser enforces navigation policies that could allow an attacker to bypass the site isolation security feature. Site isolation is a critical Chrome security boundary that prevents malicious websites from accessing data belonging to other sites. An attacker could exploit this by crafting a malicious HTML page and tricking a user into visiting it, potentially allowing unauthorized access to sensitive information from other websites the user is logged into.

• CVE-2026-15131MEDIUM 4.3

  Google Chrome versions before 150.0.7871.115 contain a flaw in how the browser handles navigation that allows an attacker to bypass site isolation, a core security boundary in Chrome. By crafting a malicious HTML page, a remote attacker can trick a user into visiting it, potentially allowing unauthorized access to data from other websites the user has open. The attack requires user interaction but no special privileges. Google rates this as Medium severity.

• CVE-2026-15187MEDIUM 4.3

  A prototype pollution vulnerability exists in enquirer, a Node.js package for interactive command-line prompts, affecting versions up to 2.4.1. The flaw allows an authenticated attacker to manipulate object prototypes through the question.name parameter when using the Enquirer.set method, potentially modifying application behavior. The vulnerability requires authenticated access and does not directly expose sensitive data, but could enable privilege escalation or unintended state changes within applications that rely on enquirer. Public exploit code is available.

• CVE-2026-15202MEDIUM 4.3

  YzmCMS versions up to 7.5 contain a cross-site scripting (XSS) vulnerability in the header handling component that allows attackers to inject malicious scripts into web pages. The flaw exists in the `get_url` function within `/yzmphp/yzmphp.php`, where the HTTP_HOST parameter is not properly sanitized before being used. An attacker can craft a malicious link that, when clicked by a user, executes arbitrary JavaScript in their browser—potentially stealing session data, credentials, or redirecting them to malicious sites. The vulnerability requires user interaction (clicking a link) but can be exploited remotely without authentication.

• CVE-2026-15286MEDIUM 4.3

  A WordPress plugin called Gutenberg Blocks with AI by Kadence WP contains a flaw that allows contributors—users with limited publishing rights—to bypass the approval process and publish posts immediately without administrator review. The vulnerability exists in a REST API endpoint used for processing patterns, where the permission check was not properly configured. This affects all versions up to and including 3.5.32.

• CVE-2026-15329MEDIUM 4.3

  CowAgent, an open-source AI agent framework, contains a vulnerability in its Browser Tool component that can leak sensitive information to authenticated users. The flaw exists in the navigation function and requires an attacker to already have login credentials. While the technical bar to exploit this is low and a proof-of-concept has been publicly released, the impact is limited to information disclosure affecting only the confidentiality of data, not its integrity or availability.