Search vulnerabilities

Expected end of text, found '–' (at char 11), (line:1, col:12)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,877

CVE-2026-106343

chromium-browser: Improper state validation in Autofill AI

Improper state validation in Autofill AI in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Google
Products
Android Chrome
CVE-2026-102428

Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Joomla CCK < 8.3.16

Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Joomla CCK < 8.3.16 - The order column for records was user provided and not properly validated, leading to a SQL injection vector.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Ordasoft Ordasoft.com
Products
Joomla Cck Ordasoft Joomla Cck
CVE-2026-106344

chromium-browser: Missing authorization in Permissions

Missing authorization in Permissions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Google
Products
Chrome
CVE-2026-106345

chromium-browser: Use of released resource in Session

Use of released resource in Session in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed
Vendors
Google
Products
Chrome
CVE-2026-87428

Local Unauthorized Credential Disclosure in Brocade ASCG Pre‑3.5.0

In Brocade ASCG before 3.5.0, a  local unauthorized user on the ASCG VM who can issue a request to the SANnav host network namespace can extract stored management credentials for onboarded SANnav instances and compromise connected Brocade SANnav servers or managed Brocade Fibre Channel switches.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Broadcom
Products
Brocade Active Support Connectivity Gateway
CVE-2026-106346

chromium-browser: Improper state validation in DevTools

Improper state validation in DevTools in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Google
Products
Chrome
CVE-2026-102775

Joomla Extension - phoca.cz - Authorisation bypass through user-controlled key (IDOR) in Order View in Phoca Cart 5.0.0 - 6.1.8

Joomla Extension - phoca.cz - Authorisation bypass through user-controlled key (IDOR) in Order View in Phoca Cart 5.0.0 - 6.1.8 - Phoca Cart's order-file download endpoint does not verify the download tokens it asks for. The d (download token) and o (order token) parameters are checked for non-emptiness only — they are never compared to the stored download_token / order_token values. As a result, any remote user (including a guest with no account at all) can download any customer's digital goods by enumerating sequential id values and supplying arbitrary non-empty tokens.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Phoca
Products
Phoca Cart Phoca Cart Extension For Joomla
CVE-2026-106347

chromium-browser: Use after free in Track

Use after free in Track in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Google
Products
Chrome
CVE-2026-106348

chromium-browser: Information leak in Animation

Information leak in Animation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security severity: Medium)

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Google
Products
Chrome
CVE-2026-87426

Unauthenticated Disclosure of SAN Fabric Management Topology via Internal Endpoints

An unauthenticated network-based attacker can query specific internal management endpoints on Brocade ASCG versions before 3.5.0 to enumerate the configuration details and state of managed Brocade Fabric OS (FOS) switches. This results in the unauthorized disclosure of the customer's SAN fabric management topology and switch connectivity attributes.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Broadcom
Products
Brocade Active Support Connectivity Gateway
CVE-2026-106349

chromium-browser: Use after free in V8

Use after free in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Google
Products
Chrome
CVE-2026-87425

TLS Client Trust Store Modification Enabling MITM

An unauthenticated remote attacker can modify the TLS client trust store in Brocade ASCG versions before 3.5.0. By supplying an unauthorized Certificate Authority (CA) certificate to an unauthenticated management interface, the attacker can cause the system to trust unauthorized certificates, potentially enabling Man-in-the-Middle (MITM) attacks against outbound communications with managed switches and peer nodes.

CVSS 4.0 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Broadcom
Products
Brocade Active Support Connectivity Gateway
CVE-2026-106350

chromium-browser: Incorrect authorization in Browser

Incorrect authorization in Browser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Google
Products
Chrome
CVE-2026-87424

Brocade ASCG Authentication Bypass via Hard‑coded Cryptographic Key

A vulnerability in the SupportLink API authentication component of Brocade ASCG versions prior to 3.5.0 allows an attacker to bypass authentication across deployments due to the use of a hard coded cryptographic key.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Broadcom
Products
Brocade Active Support Connectivity Gateway
CVE-2026-85490

ASCG Path Traversal Enables Remote Code Execution

When Brocade ASCG before 3.5.0 processes support bundle archives ingested from remote compromised endpoints, the application fails to sanitize path traversal sequences contained within archive entries prior to extraction. An unauthenticated remote attacker capable of sending or intercepting ingested archive files can leverage this flaw to write arbitrary files to restricted locations on the underlying host, potentially leading to remote code execution.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Broadcom
Products
Brocade Active Support Connectivity Gateway
CVE-2026-106351

chromium-browser: Observable discrepancy in Safebrowsing

Observable discrepancy in Safebrowsing in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Apple Google
Products
Iphone Os Chrome
CVE-2026-85489

Unauthenticated API Access Allows Privileged Configuration Changes in Brocade ASCG

An authentication flaw exists in the Brocade ASCG administrative management service component. An unauthenticated network user can issue direct API requests to perform privileged actions, including accessing sensitive system configuration mapping data, modifying managed device inventories, and altering operational settings. This vulnerability affects all versions of Brocade ASCG before 3.5.0.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Broadcom
Products
Brocade Active Support Connectivity Gateway
CVE-2026-85488

Default Password Leakage Enabling Local Privilege Escalation in Brocade ASCG

Brocade ASCG before 3.5.0 has a well-known Brocade default password embedded in a script distributed to every customer. Any local authenticated user with read access to the installation path can discover this credential and perform privilege escalation on affected Open Virtual Appliance (OVA) deployments, where default configuration settings remain in place.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed
Vendors
Broadcom
Products
Brocade Active Support Connectivity Gateway
CVE-2026-106352

chromium-browser: Incorrect authorization in WebProtect

Incorrect authorization in WebProtect in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Google
Products
Chrome