CVE-2026-40010

Apache Wicket: possible session fixation using AuthenticatedWebSession

Missing invocation of Servlet http web request method changeSessionId after session binding can be exploited for a session fixation attack in Apache Wicket. This issue affects Apache Wicket: from 8.0.0 through 8.17.0, 9.0.0, from 10.0.0 through 10.8.0. Users are recommended to upgrade to version 10.9.0, which fixes the issue.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Wicket

CVE-2026-42509

Apache Wicket: crafted strings can break out of the JavaScript sequence

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Wicket. This issue affects Apache Wicket: from 8.0.0 through 8.17.0, 9.0.0, from 10.0.0 through 10.8.0. Users are recommended to upgrade to version 10.9.0, which fixes the issue.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Wicket

CVE-2026-27416

WordPress PDF Poster plugin <= 2.4.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in bPlugins PDF Poster allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects PDF Poster: from n/a through 2.4.1.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Bplugins Wordpress

Products

Pdf Poster Wordpress

CVE-2023-6460

Information leak in nodejs-firestore

A potential logging of the firestore key via logging within nodejs-firestore exists - Developers who were logging objects through this._settings would be logging the firestore key as well potentially exposing it to anyone with logs read access. We recommend upgrading to version 6.1.0 to avoid this issue

CVSS 3.1 · 4 Medium EPSS < 1% KEV · Not listed

Vendors

Google

Products

Cloud Firestore

CVE-2025-2418

Open Redirect in TR7's Web Application Firewall

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in TR7 Cyber ​​Defense Inc. Web Application Firewall allows Phishing. This issue affects Web Application Firewall: from 4.30 before v1.4.0.117.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Tr7 Cyber ​​defense Inc.

Products

Web Application Firewall

CVE-2026-31589

mm: call ->free_folio() directly in folio_unmap_invalidate()

In the Linux kernel, the following vulnerability has been resolved: mm: call ->free_folio() directly in folio_unmap_invalidate() We can only call filemap_free_folio() if we have a reference to (or hold a lock on) the mapping. Otherwise, we've already removed the folio from the mapping so it no longer pins the mapping and the mapping can be removed, causing a use-after-free when accessing mapping->a_ops. Follow the same pattern as __remove_mapping() and load the free_folio function pointer before dropping the lock on the mapping. That lets us make filemap_free_folio() static as this was the only caller outside filemap.c.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Linux

Products

Linux Kernel

CVE-2026-7909

chromium-browser: Inappropriate implementation in ServiceWorker

Inappropriate implementation in ServiceWorker in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed

Vendors

Apple Google Linux and 1 more

Products

Macos Chrome Linux Kernel and 1 more

CVE-2026-7950

chromium-browser: Out of bounds read and write in GFX

Out of bounds read and write in GFX in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to perform arbitrary read/write via malicious network traffic. (Chromium security severity: Medium)

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Apple Google Linux and 1 more

Products

Macos Chrome Linux Kernel and 1 more

CVE-2026-7899

chromium-browser: Out of bounds read and write in V8

Out of bounds read and write in V8 in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Apple Google Linux and 1 more

Products

Macos Chrome Linux Kernel and 1 more

CVE-2026-7963

chromium-browser: Inappropriate implementation in ServiceWorker

Inappropriate implementation in ServiceWorker in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Apple Google Linux and 1 more

Products

Macos Chrome Linux Kernel and 1 more

CVE-2026-7971

chromium-browser: Inappropriate implementation in ORB

Inappropriate implementation in ORB in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Apple Google Linux and 1 more

Products

Macos Chrome Linux Kernel and 1 more

CVE-2026-7977

chromium-browser: Inappropriate implementation in Canvas

Inappropriate implementation in Canvas in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Apple Google Linux and 1 more

Products

Macos Chrome Linux Kernel and 1 more

CVE-2026-7994

chromium-browser: Inappropriate implementation in Chromoting

Inappropriate implementation in Chromoting in Google Chrome on Windows prior to 148.0.7778.96 allowed a local attacker to perform OS-level privilege escalation via a malicious file. (Chromium security severity: Medium)

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Google Microsoft

Products

Chrome Windows

CVE-2026-7978

chromium-browser: Inappropriate implementation in Companion

Inappropriate implementation in Companion in Google Chrome on Mac prior to 148.0.7778.96 allowed a remote attacker to perform OS-level privilege escalation via malicious network traffic. (Chromium security severity: Medium)

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Apple Google

Products

Macos Chrome

CVE-2026-7990

chromium-browser: Insufficient validation of untrusted input in Updater

Insufficient validation of untrusted input in Updater in Google Chrome on Windows prior to 148.0.7778.96 allowed a local attacker to perform OS-level privilege escalation via a malicious file. (Chromium security severity: Medium)

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Google Microsoft

Products

Chrome Windows

CVE-2026-7997

chromium-browser: Insufficient validation of untrusted input in Updater

Insufficient validation of untrusted input in Updater in Google Chrome on Mac prior to 148.0.7778.96 allowed a local attacker to perform OS-level privilege escalation via a malicious file. (Chromium security severity: Low)

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Apple Google

Products

Macos Chrome

CVE-2026-7923

chromium-browser: Out of bounds write in Skia

Out of bounds write in Skia in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Apple Google Linux and 1 more

Products

Macos Chrome Linux Kernel and 1 more

CVE-2026-7922

chromium-browser: Use after free in ServiceWorker

Use after free in ServiceWorker in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Apple Google Linux and 1 more

Products

Macos Chrome Linux Kernel and 1 more

CVE-2026-7920

chromium-browser: Use after free in Skia

Use after free in Skia in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Apple Google Linux and 1 more

Products

Macos Chrome Linux Kernel and 1 more

CVE-2026-7919

chromium-browser: Use after free in Aura

Use after free in Aura in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Apple Google Linux and 1 more

Products

Macos Chrome Linux Kernel and 1 more