CVE-2026-19153

chromium-browser: Google Chrome: Site isolation bypass via insufficient input validation in Workers

Insufficient validation of untrusted input in Workers in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-34486

Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor

Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116. Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.

CVSS 3.1 · 7.5 High EPSS 98.5% KEV · Listed

Vendors

Apache Redhat

Products

Tomcat Enterprise Linux Enterprise Linux Els and 4 more

CVE-2026-9077

Reliance on Untrusted Inputs in a Security Decision vulnerabilities in Model Context Protocol features

IBM Langflow OSS 1.0.0 through 1.10.3 Langflow allows remote authenticated attackers to bypass localhost-only restrictions and write arbitrary MCP server configurations to IDE configuration files on the host system.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Ibm Langflow

Products

Langflow Oss Langflow

CVE-2026-50646

.NET Framework Remote Code Execution Vulnerability

Protection mechanism failure in .NET Framework allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 7.8 High EPSS 4.0% KEV · Not listed

Vendors

Microsoft Redhat

Products

.net .net Framework Microsoft Visual Studio 2022 and 16 more

CVE-2026-64827

Telenia TVox 26.5.3 Authentication Bypass via set_env.php

Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain an authentication bypass vulnerability in set_env.php where the redirectToLoginAdminIRequestHaveAccessToken() function derives the current page name from PHP_SELF and skips authentication when the value matches 'login_admin.php'. Attackers can append '/login_admin.php' to the path of any target PHP script to cause the authentication check to pass and gain unauthenticated access to all PHP scripts under the manager HTML directory.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Teleniasoftware

Products

Tvox

CVE-2026-17681

chromium-browser: chromium-browser: Insufficient validation of untrusted input in Web Authentication

Insufficient validation of untrusted input in Web Authentication in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Google

Products

Android Chrome

CVE-2026-17996

chromium-browser: chromium-browser: Inappropriate implementation in Browser

Inappropriate implementation in Browser in Google Chrome on Mac prior to 151.0.7922.72 allowed a local attacker to bypass navigation restrictions via a malicious file. (Chromium security severity: Low)

CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed

Vendors

Apple Google

Products

Macos Chrome

CVE-2026-17856

chromium-browser: chromium-browser: Inappropriate implementation in Network

Inappropriate implementation in Network in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Apple Google

Products

Macos Chrome

CVE-2026-17926

chromium-browser: chromium-browser: Insufficient validation of untrusted input in DevTools

Insufficient validation of untrusted input in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-17929

chromium-browser: chromium-browser: Insufficient validation of untrusted input in DevTools

Insufficient validation of untrusted input in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a malicious file. (Chromium security severity: Low)

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-17837

chromium-browser: chromium-browser: Insufficient validation of untrusted input in DevTools

Insufficient validation of untrusted input in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-17821

chromium-browser: chromium-browser: Insufficient policy enforcement in Extensions

Insufficient policy enforcement in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extension. (Chromium security severity: Medium)

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-17961

chromium-browser: chromium-browser: Inappropriate implementation in Session

Inappropriate implementation in Session in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Google

Products

Android Chrome

CVE-2026-17974

chromium-browser: chromium-browser: Insufficient policy enforcement in DevTools

Insufficient policy enforcement in DevTools in Google Chrome prior to 151.0.7922.72 allowed a local attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-17686

chromium-browser: chromium-browser: Insufficient validation of untrusted input in Passwords

Insufficient validation of untrusted input in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-17953

chromium-browser: chromium-browser: Insufficient policy enforcement in WebView

Insufficient policy enforcement in WebView in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Google

Products

Android Chrome

CVE-2026-17786

chromium-browser: chromium-browser: Insufficient validation of untrusted input in DevTools

Insufficient validation of untrusted input in DevTools in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to perform privilege escalation via a crafted Chrome Extension. (Chromium security severity: Medium)

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-64642

Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale

Next.js is a React framework for building full-stack web applications. In versions 16.0.0 through 16.2.10, crafted requests targeting Next.js applications using App Router built with Turbopack and a single entry in config.i18n.locales can bypass middleware/proxy based authentication. This issue has been fixed in version 16.2.11.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Vercel

Products

Next.js

CVE-2026-16382

Mitigation bypass in the DOM: Service Workers component

Mitigation bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox Thunderbird

CVE-2026-56746

Netty has a Security Control Bypass via CORS Short-Circuit Failure

Netty is a network application framework for development of protocol servers and clients. Versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, are vulnerable to security control bypass during the origin evaluation process. CorsHandler provides a shortCircuit() configuration designed to reject unauthorized cross-origin requests immediately, acting as a security control before requests reach the application. However, due to a logical operator error in the origin evaluation process, this protection can be entirely bypassed. An attacker can bypass the short-circuit mechanism by sending a request with an Origin: null header. This failure forwards unauthorized requests to the backend application, bypassing intended access controls. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Netty

Products

Netty