Search vulnerabilities

Expected end of text, found ':' (at char 25), (line:1, col:26)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,865

CVE-2026-41689

Wallos: Shared local webhook allowlist lets low-privilege users send arbitrary requests to allowlisted internal services

Wallos is an open-source, self-hostable personal subscription tracker. In versions 4.8.4 and prior, the webhook notification feature reuses an administrator-configured local-target allowlist for every logged-in user. Any normal user can fully control a webhook URL, headers, and body, then use Wallos to send server-side requests to allowlisted internal automation services. When such a target exposes deployment or execution APIs, this can further enable adjacent-service RCE, but that downstream result is conditional on the target service. At time of publication, there are no publicly available patches.

CVSS 3.1 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Ellite
Products
Wallos
CVE-2026-41422

Daptin vulnerable to SQL injection via unvalidated goqu.L() calls in aggregate API

Daptin is a GraphQL/JSON-API headless CMS. Prior to version 0.11.4, the /aggregate/:typename endpoint accepted column and group query parameters that were passed verbatim to goqu.L() — a raw SQL literal expression builder — without any validation. This bypassed all parameterization and allowed authenticated users with any valid session to inject arbitrary SQL expressions. This issue has been patched in version 0.11.4.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Daptin
Products
Daptin
CVE-2026-8016

chromium-browser: Use after free in WebRTC

Use after free in WebRTC in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Low)

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Apple Google Linux and 1 more
Products
Macos Chrome Linux Kernel and 1 more
CVE-2026-8017

chromium-browser: Side-channel information leakage in Media

Side-channel information leakage in Media in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed
Vendors
Apple Google Linux and 1 more
Products
Macos Chrome Linux Kernel and 1 more
CVE-2026-8019

chromium-browser: Insufficient policy enforcement in WebApp

Insufficient policy enforcement in WebApp in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Apple Google Linux and 1 more
Products
Macos Chrome Linux Kernel and 1 more
CVE-2026-8020

chromium-browser: Uninitialized Use in GPU

Uninitialized Use in GPU in Google Chrome on Android prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Low)

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Google
Products
Android Chrome
CVE-2026-8009

chromium-browser: Inappropriate implementation in Cast

Inappropriate implementation in Cast in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed
Vendors
Apple Google Linux and 1 more
Products
Macos Chrome Linux Kernel and 1 more
CVE-2026-8012

chromium-browser: Inappropriate implementation in MHTML

Inappropriate implementation in MHTML in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Low)

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Apple Google Linux and 1 more
Products
Macos Chrome Linux Kernel and 1 more
CVE-2026-8013

chromium-browser: Insufficient validation of untrusted input in FedCM

Insufficient validation of untrusted input in FedCM in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Apple Google Linux and 1 more
Products
Macos Chrome Linux Kernel and 1 more
CVE-2026-8021

chromium-browser: Script injection in UI

Script injection in UI in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who convinced a user to engage in specific UI gestures to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Low)

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed
Vendors
Apple Google Linux and 1 more
Products
Macos Chrome Linux Kernel and 1 more
CVE-2026-8006

chromium-browser: Insufficient policy enforcement in DevTools

Insufficient policy enforcement in DevTools in Google Chrome prior to 148.0.7778.96 allowed an attacker who convinced a user to install a malicious extension to perform UI spoofing via a crafted Chrome Extension. (Chromium security severity: Low)

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Apple Google Linux and 1 more
Products
Macos Chrome Linux Kernel and 1 more
CVE-2026-8007

chromium-browser: Insufficient validation of untrusted input in Cast

Insufficient validation of untrusted input in Cast in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to perform privilege escalation via a crafted HTML page. (Chromium security severity: Low)

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Apple Google Linux and 1 more
Products
Macos Chrome Linux Kernel and 1 more
CVE-2026-8008

chromium-browser: Inappropriate implementation in DevTools

Inappropriate implementation in DevTools in Google Chrome prior to 148.0.7778.96 allowed an attacker who convinced a user to install a malicious extension to perform UI spoofing via a crafted Chrome Extension. (Chromium security severity: Low)

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Apple Google Linux and 1 more
Products
Macos Chrome Linux Kernel and 1 more
CVE-2026-8010

chromium-browser: Insufficient validation of untrusted input in SiteIsolation

Insufficient validation of untrusted input in SiteIsolation in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Low)

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Apple Google Linux and 1 more
Products
Macos Chrome Linux Kernel and 1 more
CVE-2026-8011

chromium-browser: Insufficient policy enforcement in Search

Insufficient policy enforcement in Search in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Apple Google Linux and 1 more
Products
Macos Chrome Linux Kernel and 1 more
CVE-2026-8014

chromium-browser: Inappropriate implementation in Preload

Inappropriate implementation in Preload in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Apple Google Linux and 1 more
Products
Macos Chrome Linux Kernel and 1 more
CVE-2026-8026

FlowiseAI Flowise API Response account.service.ts login information disclosure

A security flaw has been discovered in FlowiseAI Flowise up to 3.0.12. Affected is the function Login of the file packages/server/src/enterprise/services/account.service.ts of the component API Response Handler. The manipulation results in information disclosure. The attack can be launched remotely. A high complexity level is associated with this attack. The exploitability is told to be difficult. You should upgrade the affected component.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Flowiseai
Products
Flowise
CVE-2026-42194

Incomplete fix for CVE-2026-32812: SSRF in admidio

Admidio is an open-source user management solution. Prior to version 5.0.9, the incomplete SSRF fix in Admidio's fetch_metadata.php validates the resolved IP address but passes the original hostname-based URL to curl_init(), leaving a DNS rebinding TOCTOU window that allows redirecting requests to internal IPs. This issue has been patched in version 5.0.9.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Admidio
Products
Admidio
CVE-2026-41674

xmldom: XML injection through unvalidated DocumentType serialization

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, the package serializes DocumentType node fields (internalSubset, publicId, systemId) verbatim without any escaping or validation. When these fields are set programmatically to attacker-controlled strings, XMLSerializer.serializeToString can produce output where the DOCTYPE declaration is terminated early and arbitrary markup appears outside it. This issue has been patched in versions @xmldom/xmldom versions 0.9.10 and 0.8.13.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Xmldom
Products
Xmldom
CVE-2026-6508

RCE in TUBITAK BILGEM's Liderahenk

Origin Validation Error vulnerability in TUBITAK BILGEM Software Technologies Research Institute Liderahenk allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Liderahenk: from 2.0.1 before 2.0.2.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Tubitak Bilgem Software Technologies Research Institute
Products
Liderahenk