CVE-2026-18007

chromium-browser: chromium-browser: Inappropriate implementation in Input

Inappropriate implementation in Input in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Google

Products

Android Chrome

CVE-2026-18008

chromium-browser: chromium-browser: Inappropriate implementation in Settings

Inappropriate implementation in Settings in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via malicious network traffic. (Chromium security severity: Low)

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-18009

chromium-browser: chromium-browser: Insufficient validation of untrusted input in Passwords

Insufficient validation of untrusted input in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via malicious network traffic. (Chromium security severity: Low)

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-18010

chromium-browser: chromium-browser: Inappropriate implementation in Passwords

Inappropriate implementation in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via malicious network traffic. (Chromium security severity: Low)

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-18012

chromium-browser: chromium-browser: Use after free in PDFium

Use after free in PDFium in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file. (Chromium security severity: Low)

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-18015

chromium-browser: chromium-browser: Inappropriate implementation in Tint

Inappropriate implementation in Tint in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Apple Google

Products

Macos Chrome

CVE-2026-18017

chromium-browser: chromium-browser: Use after free in Dawn

Use after free in Dawn in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Low)

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-18018

chromium-browser: chromium-browser: Inappropriate implementation in Updater

Inappropriate implementation in Updater in Google Chrome on Windows prior to 151.0.7922.72 allowed a local attacker to perform UI spoofing via a malicious file. (Chromium security severity: Low)

CVSS 3.1 · 4 Medium EPSS < 1% KEV · Not listed

Vendors

Google Microsoft

Products

Chrome Windows

CVE-2026-18019

chromium-browser: chromium-browser: Side-channel information leakage in Media

Side-channel information leakage in Media in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-55824

Contao crawler leaks auth credentials to external hosts

Contao is an Open Source CMS. In versions 4.13.40 through 5.3.46 and 5.7.0-RC1 through 5.7.6, the crawler leaks auth credentials to external hosts. Contao's crawler tries to prevent confidential HTTP client options from being sent to external domains by creating a scoped client: full options for root page origins, cleaned options for everything else. The cleaner removes Cookie and Authorization headers, but it removes the non-Symfony option names basic_auth and bearer_auth instead of Symfony HttpClient's real auth_basic and auth_bearer options. When contao.crawl.default_http_client_options contains Basic or Bearer authentication for a protected staging/production site, those credentials remain in the "clean" client used for external links or configured additional URIs. An attacker who can get an external URL crawled, for example through a link on a crawled page while the broken-link checker is enabled, can receive the crawler credentials. This issue has been fixed in versions 5.3.47 and 5.7.7.

CVSS 3.1 · 2.6 Low EPSS < 1% KEV · Not listed

Vendors

Contao

Products

Contao

CVE-2026-65841

Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitization

Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.13.6, Jodit's clean-html denyTags filter does not normalize foreign SVG or MathML script node names, allowing a script element nested directly in SVG or MathML to remain in editor.value and execute when content is loaded. This issue is fixed in version 4.13.6.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Xdan

Products

Jodit

CVE-2026-62999

Copier: Percent-encoded dot segments in template URLs can allow trusted-prefix escape (Incomplete fix for trust-prefix bypass)

Copier is a library and CLI app for rendering project templates. From 9.5.0 through 9.16.0, percent-encoded parent-directory segments or encoded path separators in a template URL can match a configured trusted repository prefix before an HTTP server or Git transport decodes the path, allowing unsafe template features from a repository outside the trusted prefix to run after user interaction. This issue is fixed in version 9.17.0.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Copier-org

Products

Copier

CVE-2026-18394

Incorrect authorization in Strands Agents Tools http_request proxy credential exfiltration

Incorrect authorization in the http_request tool in Strands Agents Tools before 0.8.2 might allow remote attackers to obtain credentials configured via HTTP_REQUEST_TOKEN_CONFIG by influencing the LLM to route requests through actor-controlled proxy infrastructure. To remediate this issue, users should upgrade to version 0.8.2.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Aws

Products

Strands Agents Tools

CVE-2026-15658

foreUP customer REST API allows unauthenticated endpoint access

A vulnerability in the foreUP customer REST API allows any authenticated, low-privilege customer to access an endpoint that returns the records of other users without checking that the caller owns the data associated with that record.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Foreup

Products

Foreup

CVE-2026-52856

Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, a malformed packet received during the SFTP connection handshake causes a Go panic. This issue is fixed in version 1.13.0.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Pterodactyl

Products

Wings

CVE-2026-52855

Wings exposes node configuration secrets through egg configuration-file templating

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.12.3, {{config.}} placeholders in egg configuration-file templates allow a low-privileged user to read {{config.token}}, {{config.token_id}}, and {{config.docker.registries}} from the full daemon configuration. This issue is fixed in version 1.12.3.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Pterodactyl

Products

Wings

CVE-2026-46593

Authenticated SQL Injection in PHP Poll Script

A SQL injection vulnerability has been identified in the PHP Jabbers - PHP Poll Script. Improper neutralization of input provided by user to pjAdminPolls.controller.php endpoint allows an authenticated attacker to perform SQL Injection attacks. This issue was fixed in version 4.1.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Php Jabbers

Products

Php Poll Script

CVE-2026-18481

Stored XSS in Participant URL Field leads to Account Takeover via Session Token Theft

Stored cross-site scripting in the participant URL handling in AWS Ops Wheel before PR #168 might allow an authenticated remote user to steal session tokens and escalate to full administrative control of the deployed instance via a crafted participant_url value containing a dangerous URI scheme. To remediate this issue, users should redeploy from the latest version of aws-ops-wheel.

CVSS 4.0 · 6.2 Medium EPSS < 1% KEV · Not listed

Vendors

Aws

Products

Aws Ops Wheel

CVE-2025-67651

CSRF in PHP Jabbers scripts

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in multiple PHP Jabbers scripts. The lack of CSRF tokens or appropriate SameSite attributes allows an attacker to send unauthorized requests in the context of an authenticated user, leading to unauthorized administrative actions, such as creating new admin accounts. This issue was fixed in the versions specified in the affected products list.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Php Jabbers

Products

Appointment Scheduler Auto Classifieds Script Availability Booking Calendar and 32 more

CVE-2025-67650

Authenticated SQL Injection in PHP Jabbers scripts

An authenticated SQL injection vulnerability has been identified in multiple PHP Jabbers scripts. Improper neutralization of input provided by an authenticated user into parameters responsible for sorting functions allows an attacker to perform SQL Injection attacks. This issue was fixed in the versions specified in the affected products list.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Php Jabbers

Products

Appointment Scheduler Auto Classifieds Script Availability Booking Calendar and 32 more