2026

Incorrect security UI in WebAppInstalls in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to perform UI

Out of bounds read in ANGLE in Google Chrome on Windows prior to 150.0.7871.46 allowed a remote attacker to leak cross-o

Out of bounds read in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to obtain potentially sens

Out of bounds read in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to obtain potentially sens

Out of bounds read in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to leak cross-origin data

Uninitialized Use in Dawn in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to obtain potentially sensit

Uninitialized Use in ANGLE in Google Chrome on Windows prior to 150.0.7871.46 allowed a remote attacker to obtain potent

Inappropriate implementation in PDFium in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to perform UI s

Uninitialized Use in Dawn in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to obtain potentially sensit

Uninitialized Use in Dawn in Google Chrome on ChromeOS prior to 150.0.7871.46 allowed a remote attacker to obtain potent

The User Registration & Membership WordPress plugin before 5.2.0 does not enforce payment completion before activating

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to generic SQL Injection

The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to Arbitrary File Copy via

Subscriber Sensitive Data Exposure in Corpkit <= 1.0.5 versions.

Unauthenticated Broken Access Control in Motors <= 5.6.80 versions.

Path Traversal: '.../...//' vulnerability in Addify Tax Exempt for WooCommerce allows Path Traversal. This issue affect

Subscriber Cross Site Scripting (XSS) in ShortPixel Adaptive Images <= 3.11.3 versions.

Subscriber Sensitive Data Exposure in Hotel Booking Lite <= 6.0.3 versions.

Subscriber Broken Access Control in Link Whisper Premium <= 2.9.0 versions.

Subscriber Cross Site Scripting (XSS) in JetReviews <= 3.0.0.1 versions.

Subscriber Broken Access Control in Classified Listing <= 5.4.2 versions.

Subscriber Broken Access Control in Advanced Contact form 7 DB <= 2.0.9 versions.

Unauthenticated Insecure Direct Object References (IDOR) in Kirki <= 6.0.11 versions.

Contributor Cross Site Scripting (XSS) in TheFox <= 3.9.70 versions.

Contributor Broken Access Control in Flatsome <= 3.20.5 versions.

Unauthenticated Cross Site Request Forgery (CSRF) in Booked <= 3.0.0 versions.

Contributor Cross Site Scripting (XSS) in Livemesh Addons for WPBakery Page Builder <= 3.9.4 versions.

Contributor Cross Site Scripting (XSS) in Mosaic Gallery &#8211; Advanced Gallery <= 1.2.0 versions.

Contributor Cross Site Scripting (XSS) in Structured Content <= 1.7.0 versions.

Contributor Cross Site Scripting (XSS) in Surbma | Yoast SEO Breadcrumb Shortcode <= 1.2 versions.

LobeChat before version 2.2.10-canary.15 contains a regular expression denial of service (ReDoS) vulnerability that allo

LobeChat through 2.2.9 contains a broken access control vulnerability in the retrieval-augmented-generation semantic sea

Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of s

libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated ones, even when

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 r

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 r

Microsoft Edge (Chromium-based) Spoofing Vulnerability

Exposure of sensitive information to an unauthorized actor in Microsoft Edge (Chromium-based) allows an unauthorized att

Server-side request forgery (ssrf) in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofin

SSRF via HTTP Redirect in Repository Migration

Improper access control in Microsoft Edge for Android allows an unauthorized attacker to bypass a security feature over

A weakness has been identified in zhayujie chatgpt-on-wechat CowAgent 2.1.0. This issue affects the function verify_serv

Mojo::JSON versions before 9.47 for Perl allow memory exhaustion via unbounded recursion in the pure-Perl decoder. The

A security vulnerability has been detected in Formbricks 5.0.0. This impacts an unknown function of the file apps/web/mo

Improper Input Validation, Unintended Proxy or Intermediary ('Confused Deputy') vulnerability in Apache Camel DAPR compo

Improper Input Validation, Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Inject

The OpenAI Codex desktop app for macOS rendered remote images from Markdown in model responses. An attacker who could pl

vLLM is an inference and serving engine for large language models. From 0.22.0 to 0.23.0, the /v1/audio/transcriptions a

Hugo is a static site generator. From v0.123.0 through v0.163.0, Hugo's virtual filesystem is designed so that files und

vLLM is a library for LLM inference and serving. From 0.12.0 to before 0.24.0, sending a pure prompt embeds payload in a