CVE-2026-110140

chromium-browser: Type confusion in V8

Type confusion in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-110139

chromium-browser: Use after free in Media

Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-56590

HCL BigFix Service Management is affected by multiple security vulnerabilities.

HCL BigFix Service Management is affected by an Unrestricted File Upload vulnerability due to improper file validation controls, which could allow an unauthenticated attacker to upload and execute malicious payloads, resulting in a complete server compromise.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Bigfix Service Management

CVE-2026-110138

chromium-browser: Use after free in ShapeDetection

Use after free in ShapeDetection in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-110137

chromium-browser: Use after free in WebRTC

Use after free in WebRTC in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-110136

chromium-browser: Use after free in PDF

Use after free in PDF in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-70181

ASP.NET Core Denial of Service Vulnerability

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

CVSS 3.1 · 7.5 High EPSS 1.2% KEV · Not listed

Vendors

Microsoft

Products

Asp.net Core Microsoft Visual Studio 2026 Version 18.10 Visual Studio 2022

CVE-2026-110155

chromium-browser: Buffer overflow in PDFium

Buffer overflow in PDFium in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-110156

chromium-browser: Incorrect reference resolution in Extensions

Incorrect reference resolution in Extensions in Google Chrome on on Mac prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: High)

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Apple Google

Products

Macos Chrome

CVE-2026-110157

chromium-browser: Use after free in SVG

Use after free in SVG in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-110158

chromium-browser: Use after free in Passwords

Use after free in Passwords in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-110159

chromium-browser: Incorrect authorization in Updater

Incorrect authorization in Updater in Google Chrome prior to 155.0.8059.79 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High)

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-105719

Microsoft SharePoint Server Information Disclosure Vulnerability

Improper input validation in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.

CVSS 3.1 · 6.5 Medium EPSS 1.1% KEV · Not listed

Vendors

Microsoft

Products

Sharepoint Server

CVE-2026-108398

.NET Framework Security Feature Bypass Vulnerability

Untrusted search path in .NET Framework allows an authorized attacker to bypass a security feature locally.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

.net .net Framework

CVE-2026-69370

Visual Studio Code Remote Code Execution Vulnerability

Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Visual Studio Code

CVE-2026-105713

Microsoft Office SharePoint Spoofing Vulnerability

Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over an adjacent network.

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Sharepoint Server

CVE-2026-105728

Dynamics Business Central Information Disclosure Vulnerability

Improper authentication in Dynamics Business Central allows an unauthorized attacker to disclose information over a network.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Dynamics Nav 2018

CVE-2026-110160

chromium-browser: Missing authorization in ReadingMode

Missing authorization in ReadingMode in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially bypass site isolation via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-21848

HCL BigFix Service Management is affected by multiple security vulnerabilities.

HCL BigFix Service Management is affected by a Security Misconfiguration vulnerability, which could allow an authenticated attacker to exploit improper access controls, enabling the unauthorized viewing of restricted data elements across tenant boundaries.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Bigfix Service Management

CVE-2026-110161

chromium-browser: Use after free in Network

Use after free in Network in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Critical)

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome