Mon, Apr 14 · 07:15 PM CDTCVE-2025-1782
9.9/10 · Must read/watchNVDvuln
Summary
In HylaFAX Enterprise Web Interface and AvantFAX, the language form element is not properly sanitized before being used and can be misused to include an arbitrary file in the PHP code allowing an attacker to do anything as the web server user. This flaw requires the attacker to be authenticated with a valid user accoun
CVECVE-2025-1782
SeverityCRITICAL
TypeUPDATED
PublishedMon, Apr 14 · 07:15 PM CDT
ModifiedTue, May 26 · 07:08 PM CDT
CVE-2012-10060
9.8/10 · Must read/watchNVDvuln
Summary
Sysax Multi Server versions prior to 5.55 contain a stack-based buffer overflow in its SSH service. When a remote attacker supplies an overly long username during authentication, the server copies the input to a fixed-size stack buffer without proper bounds checking. This allows remote code execution under the context
CVECVE-2012-10060
SeverityCRITICAL
TypeUPDATED
PublishedWed, Aug 13 · 09:15 PM CDT
ModifiedTue, May 26 · 02:16 PM CDT
CVE-2025-34186
9.8/10 · Must read/watchNVDvuln
Summary
Ilevia EVE X1/X5 Server version ≤ 4.7.18.0.eden contains a vulnerability in its authentication mechanism. Unsanitized input is passed to a system() call for authentication, allowing attackers to inject special characters and manipulate command parsing. Because the binary interprets non-zero exit codes from system() as
CVECVE-2025-34186
SeverityCRITICAL
TypeUPDATED
PublishedTue, Sep 16 · 08:15 PM CDT
ModifiedTue, May 26 · 02:16 PM CDT
CVE-2025-34523
9.8/10 · Must read/watchNVDvuln
Summary
A heap-based buffer overflow vulnerability exists in the network-facing input handling routines of Arcserve Unified Data Protection (UDP). This flaw is reachable without authentication and results from improper bounds checking when processing attacker-controlled input. By sending specially crafted data, a remote attack
CVECVE-2025-34523
SeverityCRITICAL
TypeUPDATED
PublishedWed, Aug 27 · 10:15 PM CDT
ModifiedTue, May 26 · 02:16 PM CDT
CVE-2026-22189
9.8/10 · Must read/watchNVDvuln
Summary
The egg-mkfont utility in Panda3D versions up to and including 1.10.16 contains a stack-based buffer overflow vulnerability due to use of an unbounded sprintf() call with attacker-controlled input. When constructing glyph filenames, egg-mkfont formats a user-supplied glyph pattern (-gp) into a fixed-size stack buffer w
CVECVE-2026-22189
SeverityCRITICAL
TypeUPDATED
PublishedWed, Jan 07 · 09:16 PM CST
ModifiedTue, May 26 · 02:16 PM CDT
CVE-2026-22208
9.6/10 · Must read/watchNVDvuln
Summary
OpenS100 (the reference implementation S-100 viewer) prior to commit 753cf29 contains a remote code execution vulnerability via an unrestricted Lua interpreter. The Portrayal Engine initializes Lua using luaL_openlibs() without sandboxing or capability restrictions, exposing standard libraries such as 'os' and 'io' to
CVECVE-2026-22208
SeverityCRITICAL
TypeUPDATED
PublishedTue, Feb 17 · 03:16 PM CST
ModifiedTue, May 26 · 02:16 PM CDT
CVE-2026-6068
9.6/10 · Must read/watchNVDvuln
Summary
NASM contains a heap use after free vulnerability in response file (-@) processing where a dangling pointer to freed memory is stored in the global depend_file and later dereferenced, as the response-file buffer is freed before the pointer is used, allowing for data corruption or remote code execution.
CVECVE-2026-6068
SeverityCRITICAL
TypeUPDATED
PublishedFri, Apr 10 · 02:16 PM CDT
ModifiedTue, May 26 · 08:00 PM CDT
CVE-2026-6296
9.6/10 · Must read/watchNVDvuln
Summary
Heap buffer overflow in ANGLE in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)
CVECVE-2026-6296
SeverityCRITICAL
TypeUPDATED
PublishedWed, Apr 15 · 08:16 PM CDT
ModifiedTue, May 26 · 06:16 PM CDT
CVE-2026-6919
9.6/10 · Must read/watchNVDvuln
Summary
Use after free in DevTools in Google Chrome prior to 147.0.7727.117 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
CVECVE-2026-6919
SeverityCRITICAL
TypeUPDATED
PublishedThu, Apr 23 · 06:16 PM CDT
ModifiedTue, May 26 · 07:16 PM CDT
CVE-2026-6920
9.6/10 · Must read/watchNVDvuln
Summary
Out of bounds read in GPU in Google Chrome on Android prior to 147.0.7727.117 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
CVECVE-2026-6920
SeverityCRITICAL
TypeUPDATED
PublishedThu, Apr 23 · 06:16 PM CDT
ModifiedTue, May 26 · 06:16 PM CDT
CVE-2026-26980
9.4/10 · Must read/watchNVDvuln
Summary
Ghost is a Node.js content management system. Versions 3.24.0 through 6.19.0 allow unauthenticated attackers to perform arbitrary reads from the database. This issue has been fixed in version 6.19.1.
CVECVE-2026-26980
SeverityCRITICAL
TypeUPDATED
PublishedFri, Feb 20 · 02:16 AM CST
ModifiedTue, May 26 · 03:16 PM CDT
CVE-2026-23455
9.1/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() In DecodeQ931(), the UserUserIE code path reads a 16-bit length from the packet, then decrements it by 1 to skip the protocol discriminator byte before passing it to DecodeH323_UserInf
CVECVE-2026-23455
SeverityCRITICAL
TypeUPDATED
PublishedFri, Apr 03 · 04:16 PM CDT
ModifiedTue, May 26 · 02:43 PM CDT
CVE-2026-5426
9.1/10 · Must read/watchNVDvuln
Summary
Hard-coded ASP.NET/IIS machineKey value in Digital Knowledge KnowledgeDeliver deployments prior to February 24, 2026 allows adversaries to circumvent ViewState validation mechanisms and achieve remote code execution via malicious ViewState deserialization attacks
CVECVE-2026-5426
SeverityCRITICAL
TypeUPDATED
PublishedThu, Apr 16 · 04:16 PM CDT
ModifiedTue, May 26 · 07:16 PM CDT
CVE-2013-10050
8.8/10 · Worth your timeNVDvuln
Summary
An OS command injection vulnerability exists in multiple D-Link routers (confirmed on DIR-300 rev A v1.05 and DIR-615 rev D v4.13) via the authenticated tools_vct.xgi CGI endpoint. The web interface fails to properly sanitize user-supplied input in the pingIp parameter, allowing attackers with valid credentials to inje
CVECVE-2013-10050
SeverityHIGH
TypeUPDATED
PublishedFri, Aug 01 · 09:15 PM CDT
ModifiedTue, May 26 · 02:16 PM CDT
CVE-2026-5860
8.8/10 · Worth your timeNVDvuln
Summary
Use after free in WebRTC in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
CVECVE-2026-5860
SeverityHIGH
TypeUPDATED
PublishedWed, Apr 08 · 10:16 PM CDT
ModifiedTue, May 26 · 07:16 PM CDT
CVE-2026-5865
8.8/10 · Worth your timeNVDvuln
Summary
Type Confusion in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
CVECVE-2026-5865
SeverityHIGH
TypeUPDATED
PublishedWed, Apr 08 · 10:16 PM CDT
ModifiedTue, May 26 · 07:16 PM CDT
CVE-2026-5879
8.8/10 · Worth your timeNVDvuln
Summary
Insufficient validation of untrusted input in ANGLE in Google Chrome on Mac prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVECVE-2026-5879
SeverityHIGH
TypeUPDATED
PublishedWed, Apr 08 · 10:16 PM CDT
ModifiedTue, May 26 · 07:16 PM CDT
CVE-2026-6299
8.8/10 · Worth your timeNVDvuln
Summary
Use after free in Prerender in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)
CVECVE-2026-6299
SeverityHIGH
TypeUPDATED
PublishedWed, Apr 15 · 08:16 PM CDT
ModifiedTue, May 26 · 07:16 PM CDT
CVE-2026-6300
8.8/10 · Worth your timeNVDvuln
Summary
Use after free in CSS in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
CVECVE-2026-6300
SeverityHIGH
TypeUPDATED
PublishedWed, Apr 15 · 08:16 PM CDT
ModifiedTue, May 26 · 06:16 PM CDT
CVE-2026-6301
8.8/10 · Worth your timeNVDvuln
Summary
Type Confusion in Turbofan in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
CVECVE-2026-6301
SeverityHIGH
TypeUPDATED
PublishedWed, Apr 15 · 08:16 PM CDT
ModifiedTue, May 26 · 07:16 PM CDT
CVE-2026-6302
8.8/10 · Worth your timeNVDvuln
Summary
Use after free in Video in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
CVECVE-2026-6302
SeverityHIGH
TypeUPDATED
PublishedWed, Apr 15 · 08:16 PM CDT
ModifiedTue, May 26 · 06:16 PM CDT
CVE-2026-6306
8.8/10 · Worth your timeNVDvuln
Summary
Heap buffer overflow in PDFium in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file. (Chromium security severity: High)
CVECVE-2026-6306
SeverityHIGH
TypeUPDATED
PublishedWed, Apr 15 · 08:16 PM CDT
ModifiedTue, May 26 · 07:16 PM CDT
CVE-2026-6315
8.8/10 · Worth your timeNVDvuln
Summary
Use after free in Permissions in Google Chrome on Android prior to 147.0.7727.101 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
CVECVE-2026-6315
SeverityHIGH
TypeUPDATED
PublishedWed, Apr 15 · 08:16 PM CDT
ModifiedTue, May 26 · 06:16 PM CDT
CVE-2026-6317
8.8/10 · Worth your timeNVDvuln
Summary
Use after free in Cast in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
CVECVE-2026-6317
SeverityHIGH
TypeUPDATED
PublishedWed, Apr 15 · 08:16 PM CDT
ModifiedTue, May 26 · 07:16 PM CDT
CVE-2026-6360
8.8/10 · Worth your timeNVDvuln
Summary
Use after free in FileSystem in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page. (Chromium security severity: High)
CVECVE-2026-6360
SeverityHIGH
TypeUPDATED
PublishedWed, Apr 15 · 08:16 PM CDT
ModifiedTue, May 26 · 07:16 PM CDT
