CVE-2026-102457

DigiWin｜EasyFlow .NET - Arbitrary File Read

EasyFlow .NET developed by Digiwin has an Arbitrary File Read vulnerability. Authenticated remote attackers can exploit this vulnerability to download arbitrary system files.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Digiwin

Products

Easyflow .net

CVE-2026-102458

DigiWin｜EasyFlow .NET - Missing Authentication

EasyFlow .NET developed by Digiwin has a Missing Authentication vulnerability. Unauthenticated remote attackers can obtain other users' plaintext passwords through a specific API.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Digiwin

Products

Easyflow .net

CVE-2026-102459

DigiWin｜EasyFlow .NET - Reflected Cross-site Scripting

EasyFlow .NET developed by Digiwin has a Reflected Cross-site Scripting vulnerability. Unauthenticated remote attackers can execute arbitrary JavaScript codes in user's browser through phishing attacks.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Digiwin

Products

Easyflow .net

CVE-2026-102456

DigiWin｜EasyFlow .NET - SQL Injection

EasyFlow .NET developed by Digiwin has an SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL commands to read database contents.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Digiwin

Products

Easyflow .net

CVE-2026-102455

DigiWin｜EasyFlow .NET - Insecure Deserialization

EasyFlow .NET developed by Digiwin has a Insecure Deserialization vulnerability. Unauthenticated remote attackers can execute arbitrary code on the server by sending maliciously crafted serialized content.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Digiwin

Products

Easyflow .net

CVE-2026-95288

chromium-browser: UI misrepresentation in Mobile

UI misrepresentation in Mobile in Google Chrome on on iOS prior to 154.0.8037.57 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Apple Google

Products

Iphone Os Chrome

CVE-2026-95289

chromium-browser: Incorrect authorization in Scroll

Incorrect authorization in Scroll in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-95282

chromium-browser: chromium-browser: Use after free in Platform

Use after free in Platform in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-62097

WordPress Business Directory plugin <= 6.4.27 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPTasty Business Directory business-directory-plugin allows Blind SQL Injection.This issue affects Business Directory: from n/a through 6.4.27.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-95291

chromium-browser: chromium-browser: UI misrepresentation in SecurityIndicators

UI misrepresentation in SecurityIndicators in Google Chrome on on iOS prior to 154.0.8037.57 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Apple Google

Products

Iphone Os Chrome

CVE-2026-102623

Kubevirt: kubevirt: virt-controller nil-pointer dereference via malformed ephemeral volume

A flaw was found in KubeVirt. An authenticated user with permission to create Virtual Machine Instances (VMIs) can cause a Denial of Service (DoS) by submitting a virtual machine definition with an empty ephemeral volume. The virt-controller component fails to properly validate the volume configuration, leading to an unhandled exception and application crash during processing. Because the malformed definition persists in the cluster, the controller enters a continuous crash loop, disrupting virtual machine lifecycle operations across the entire environment.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Kubevirt Redhat

Products

Kubevirt Container Native Virtualization

CVE-2026-95312

chromium-browser: Information leak in Passwords

Information leak in Passwords in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-95313

chromium-browser: Use after free in Fullscreen

Use after free in Fullscreen in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-95315

chromium-browser: chromium-browser: Use after free in Aura

Use after free in Aura in Google Chrome prior to 154.0.8037.57 allowed a local attacker to potentially execute arbitrary code outside the sandbox via UI Interaction. (Chromium security severity: High)

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-95316

chromium-browser: chromium-browser: Unchecked return value in Performance

Unchecked return value in Performance in Google Chrome prior to 154.0.8037.57 allowed a local attacker to potentially read memory via a local program. (Chromium security severity: Low)

CVSS 3.1 · 2.9 Low EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-95317

chromium-browser: chromium-browser: Incorrect authorization in MediaCapture

Incorrect authorization in MediaCapture in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to obtain cross-origin data via a crafted Chrome extension. (Chromium security severity: Medium)

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-81433

Fireware OS Pre-Authentication Stack Buffer Overflow in fingerd Allows Remote Code Execution

A stack-based buffer overflow vulnerability in WatchGuard Fireware OS's DHCP fingerprinting daemon (fingerd) allows an unauthenticated attacker with adjacent network access to execute arbitrary code or crash the process by sending a specially crafted DHCP packet.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Watchguard

Products

Fireware Os

CVE-2026-95318

chromium-browser: Buffer overflow in Video

Buffer overflow in Video in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-95319

chromium-browser: Use after free in Printing

Use after free in Printing in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-95320

chromium-browser: Missing authorization in Navigation

Missing authorization in Navigation in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to spoof address bar via a crafted HTML page. (Chromium security severity: Medium)

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome