CVE-2026-126847

chromium-browser: chromium-browser: Arbitrary code execution via type confusion in V8

Type confusion in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-126849

chromium-browser: chromium-browser: Type confusion in V8

Type confusion in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-126859

chromium-browser: Link following in FileSystem

Link following in FileSystem in Google Chrome prior to 157.0.8103.78 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-126860

chromium-browser: Incorrect authorization in FileSystem

Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.78 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-126861

chromium-browser: chromium-browser: Arbitrary code execution via crafted HTML page

Use after free in Media in Google Chrome on on Android prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Google

Products

Android Chrome

CVE-2026-126877

chromium-browser: Use after free in Dawn

Use after free in Dawn in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-126879

chromium-browser: chromium-browser: Arbitrary code execution via crafted HTML page

Use after free in Layout in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-126880

chromium-browser: chromium-browser: Arbitrary code execution via crafted HTML page

Type confusion in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-126881

chromium-browser: Improper initialization in Media

Improper initialization in Media in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-126883

chromium-browser: chromium-browser: Arbitrary code execution via use-after-free in Core

Use after free in Core in Google Chrome on on Windows prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Google Microsoft

Products

Chrome Windows

CVE-2026-124686

JavaScript Code Injection through kendo.init() in Kendo UI for jQuery

In Progress® Kendo® UI for jQuery versions prior to 2026.4.1111, kendo.init() compiles data-* attribute values with new Function when an invalid JSON object is supplied. An attacker with low privileges who can control these attribute values can inject JavaScript that executes during declarative widget initialization when a user loads or interacts with an affected page. Successful exploitation can compromise the confidentiality and integrity of data accessible in the user's browser context. The issue was reported in version 2022.3.1109; the first affected release has not been established.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Progress

Products

Kendo Ui For Jquery

CVE-2026-124687

Cross-Site Scripting in DropDownButton and SplitButton Items in Kendo UI for jQuery

In Progress® Kendo® UI for jQuery versions from 2022.2.621 prior to 2026.4.1111 the DropDownButton and SplitButton allow markup injection through the `id` and `target` attributes. An attacker who can influence these item values can break out of the attributes and inject markup, including event handlers. The issue is fixed in 2026.4.1111.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Progress

Products

Kendo Ui For Jquery

CVE-2026-124688

Cross-Site Scripting via the spriteCssClass Field in Kendo UI for jQuery

In Progress® Kendo® UI for jQuery prior to 2026.4.1111 the TabStrip, PanelBar, and Menu widgets support mapping a dataSource field to `spriteCssClass`. If an attacker can control the mapped data, they can break out of the attribute and inject markup, including event-handler attributes. The resulting JavaScript executes in the application's origin when a victim loads a page that renders the affected widget, allowing access to data and actions available in the victim's authenticated session.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Progress

Products

Kendo Ui For Jquery

CVE-2026-124689

Cross-Site Scripting in Kendo UI for jQuery ActionSheet Header Labels

In Progress Kendo UI for jQuery versions 2026.3.1014 up to, but not including, 2026.4.1110, ActionSheet does not encode title, subtitle, and header button label values before rendering them. An attacker who can influence these values can inject markup that executes as JavaScript when a user opens the ActionSheet. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. The report identifies version 2026.3.1014; the first affected release has not been established.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Progress

Products

Kendo Ui For Jquery

CVE-2026-124692

Cross-Site Scripting in Kendo UI for jQuery Grid and TreeList Column Reordering

In Progress Kendo UI for jQuery versions 2026.3.1015 up to, but not including, 2026.4.1110, the Grid and TreeList column-reorder drag clue reparses header text as HTML. An attacker who can influence a column field or title used by an affected application can cause JavaScript to execute when a user drags a column header while column reordering is enabled. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. The first affected release has not been established.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Progress

Products

Kendo Ui For Jquery

CVE-2026-124693

Cross-Site Scripting in Kendo UI for jQuery PivotGrid Axis Chips

In Progress Kendo UI for jQuery versions 2026.3.1015 up to, but not including, 2026.4.1110, PivotGrid and PivotConfigurator axis field names are passed to a chip template without appropriate encoding. An attacker who can influence an axis field name can cause JavaScript to execute when a user views the rendered chip. The field name can be interpreted as HTML in both attribute and element contexts. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. The first affected release has not been established.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Progress

Products

Kendo Ui For Jquery

CVE-2026-124694

Cross-Site Scripting in Kendo UI for jQuery PropertyGrid Values and Descriptions

In Progress Kendo UI for jQuery versions 2026.3.1015 up to, but not including, 2026.4.1110, PropertyGrid does not encode bound property values and items[].description in its default configuration. An attacker who can influence either value can cause JavaScript to execute when a user views the grid. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. The first affected release has not been established.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Progress

Products

Kendo Ui For Jquery

CVE-2026-124647

TI WooCommerce Wishlist < 2.0.7 - Unauthenticated SQLi via tinv_wishlistkey Cookie

The TI WooCommerce Wishlist WordPress plugin before 2.0.7 does not sanitise and escape user input before using it in a SQL statement in a front-end endpoint, allowing unauthenticated users to perform SQL injection attacks.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Ti Woocommerce Wishlist

CVE-2026-124648

TI WooCommerce Wishlist < 2.13.0 - Unauthenticated Wishlist Item Deletion via Share Key

The TI WooCommerce Wishlist WordPress plugin before 2.13.0 does not verify that a visitor who is not logged in owns a registered user's wishlist before letting them manage it, allowing unauthenticated users who know or guess a wishlist's share key to delete items from other customers' wishlists.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Ti Woocommerce Wishlist

CVE-2026-110003

Azul Payara Administration REST Interface Authentication Bypass via X-GlassFish-authToken Header Leading to Remote Code Execution

A vulnerability in the administration REST interface of Azul Payara allows a remote, unauthenticated attacker to bypass secure-admin remote-access restrictions by supplying an arbitrary value in the X-GlassFish-authToken HTTP header. The header's presence waives the remote-rejection check before the token is validated, and an invalid token falls through to password-based authentication, which succeeds without credentials on default domains configured with an empty administrative password. Successful exploitation grants execution of arbitrary administrative commands, equivalent to complete compromise of the server.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Payara

Products

Payara Server