Export limit exceeded: 375803 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (375803 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-79244 | 1 Google | 1 Chrome | 2026-08-26 | 8.8 High |
| Use after free in Animation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-79087 | 1 Google | 1 Chrome | 2026-08-26 | N/A |
| Injection in Chrome Tabs in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-63404 | 1 Contribsys | 1 Faktory | 2026-08-26 | N/A |
| Faktory is a language-agnostic background job server. In versions prior to 1.10.0, the embedded Redis bootstrapper is vulnerable to an insecure temporary file flaw that lets a local unprivileged user hijack the Redis configuration and escalate to root. It writes its startup configuration to a fixed, predictable, world-writable path, /tmp/redis.conf, only creating the file if it does not already exist and never validating it on later boots. Because /tmp is world-writable, a local unprivileged user can pre-create /tmp/redis.conf with attacker-chosen Redis directives before Faktory starts, and Faktory will use the planted file verbatim. Faktory only overrides the unixsocket, dir, and logfile options, leaving directives such as bind, protected-mode, requirepass, and loadmodule attacker-controlled. This lets an attacker silently expose the entire job queue over an unauthenticated network port with no visible error to the administrator. Because the official systemd unit runs Faktory, and the redis-server child it spawns, as root, an attacker can also supply a loadmodule directive to execute arbitrary native code in the root-owned Redis process, escalating from a local unprivileged user to root. This issue is fixed in version 1.10.0. | ||||
| CVE-2026-9146 | 2026-08-26 | N/A | ||
| This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | ||||
| CVE-2026-79241 | 1 Google | 1 Chrome | 2026-08-26 | N/A |
| Out of bounds read in GPU in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-79229 | 1 Google | 1 Chrome | 2026-08-26 | N/A |
| Uninitialized resource in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-79050 | 1 Google | 1 Chrome | 2026-08-26 | N/A |
| Incorrect authorization in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-79221 | 1 Google | 1 Chrome | 2026-08-26 | N/A |
| Uninitialized resource in Dawn in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-79259 | 1 Google | 1 Chrome | 2026-08-26 | N/A |
| Improper input validation in Safebrowsing in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions via a crafted file. (Chromium security severity: Medium) | ||||
| CVE-2026-79226 | 1 Google | 1 Chrome | 2026-08-26 | N/A |
| Improper privilege management in Regional Capabilities in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Medium) | ||||
| CVE-2026-79266 | 1 Google | 1 Chrome | 2026-08-26 | 8.8 High |
| Use after free in DevTools in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted Chrome extension. (Chromium security severity: Medium) | ||||
| CVE-2026-79151 | 1 Google | 1 Chrome | 2026-08-26 | N/A |
| Improper input validation in Safebrowsing in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions via a crafted file. (Chromium security severity: Medium) | ||||
| CVE-2026-79289 | 1 Google | 1 Chrome | 2026-08-26 | N/A |
| Improper control of a resource through its lifetime in Workers in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-2035364 | 1 Openstack | 1 Keystone | 2026-08-26 | 8.1 High |
| A flaw was found in OpenStack Keystone where delegation boundary enforcement is incomplete across trust, application credential, and OAuth1 authorization endpoints. Tokens obtained via delegated authentication methods, such as OAuth1 access tokens or custom Keystone authentication plugins, can perform operations beyond their intended scope because endpoint guards only recognized specific delegation types rather than using a comprehensive allowlist. This allows creating trusts that delegate roles beyond the token's authorized scope, creating persistent application credentials, and authorizing new OAuth1 delegations. These derived credentials persist independently and survive revocation of the original credential, enabling an attacker with a compromised narrow-scope credential to escalate to the user's full privileges and maintain persistent access. | ||||
| CVE-2026-79016 | 1 Google | 1 Chrome | 2026-08-26 | N/A |
| Observable discrepancy in SVG in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-78941 | 1 Google | 1 Chrome | 2026-08-26 | N/A |
| Information leak in Core in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-78898 | 1 Google | 1 Chrome | 2026-08-26 | N/A |
| Incorrect authorization in Downloads in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-79270 | 1 Google | 1 Chrome | 2026-08-26 | N/A |
| Uninitialized resource in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-79213 | 1 Google | 1 Chrome | 2026-08-26 | N/A |
| Incorrect authorization in WebAppInstalls in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-79285 | 1 Google | 1 Chrome | 2026-08-26 | N/A |
| Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) | ||||