Thu, Jun 04 · 11:17 PM CDTCVE-2026-10971
9.6/10 · Must read/watchNVDvuln
Summary
Insufficient validation of untrusted input in Printing in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
CVECVE-2026-10971
SeverityCRITICAL
TypeUPDATED
PublishedThu, Jun 04 · 11:17 PM CDT
ModifiedSat, Jun 06 · 01:16 PM CDT
CVE-2026-10990
9.6/10 · Must read/watchNVDvuln
Summary
Use after free in Glic in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
CVECVE-2026-10990
SeverityCRITICAL
TypeUPDATED
PublishedThu, Jun 04 · 11:17 PM CDT
ModifiedSat, Jun 06 · 05:16 PM CDT
CVE-2026-11002
9.6/10 · Must read/watchNVDvuln
Summary
Use after free in Autofill in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
CVECVE-2026-11002
SeverityCRITICAL
TypeUPDATED
PublishedThu, Jun 04 · 11:17 PM CDT
ModifiedSat, Jun 06 · 06:16 PM CDT
CVE-2026-11009
9.6/10 · Must read/watchNVDvuln
Summary
Use after free in USB in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
CVECVE-2026-11009
SeverityCRITICAL
TypeUPDATED
PublishedThu, Jun 04 · 11:17 PM CDT
ModifiedSat, Jun 06 · 06:16 PM CDT
CVE-2026-11211
8.8/10 · Worth your timeNVDvuln
Summary
Integer overflow in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVECVE-2026-11211
SeverityHIGH
TypeUPDATED
PublishedThu, Jun 04 · 11:17 PM CDT
ModifiedSat, Jun 06 · 01:16 PM CDT
CVE-2026-11413
8.8/10 · Worth your timeNVDvuln
Summary
A security vulnerability has been detected in JingDong JD Cloud Box AX6600 4.5.3.r4546. The impacted element is the function set_macfilter of the file /sbin/jdcweb_rpc. The manipulation leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may
CVECVE-2026-11413
SeverityHIGH
TypeNEW
PublishedSat, Jun 06 · 02:16 PM CDT
ModifiedSat, Jun 06 · 02:16 PM CDT
CVE-2026-26422
8.4/10 · Worth your timeNVDvuln
Summary
clash-verge-service-ipc before 2.3.0 has a world-reachable IPC endpoint, leading to local privilege escalation.
CVECVE-2026-26422
SeverityHIGH
TypeNEW
PublishedSat, Jun 06 · 11:16 PM CDT
ModifiedSat, Jun 06 · 11:16 PM CDT
CVE-2026-11010
8.3/10 · Worth your timeNVDvuln
Summary
Use after free in WebShare in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
CVECVE-2026-11010
SeverityHIGH
TypeUPDATED
PublishedThu, Jun 04 · 11:17 PM CDT
ModifiedSat, Jun 06 · 06:16 PM CDT
CVE-2026-11012
8.3/10 · Worth your timeNVDvuln
Summary
Use after free in Serial in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
CVECVE-2026-11012
SeverityHIGH
TypeUPDATED
PublishedThu, Jun 04 · 11:17 PM CDT
ModifiedSat, Jun 06 · 06:16 PM CDT
CVE-2026-11072
7.8/10 · Worth your timeNVDvuln
Summary
Use after free in WebView in Google Chrome on Android prior to 149.0.7827.53 allowed a local attacker to execute arbitrary code via a malicious file. (Chromium security severity: Medium)
CVECVE-2026-11072
SeverityHIGH
TypeUPDATED
PublishedThu, Jun 04 · 11:17 PM CDT
ModifiedSat, Jun 06 · 01:16 PM CDT
CVE-2026-11103
7.8/10 · Worth your timeNVDvuln
Summary
Inappropriate implementation in Installer in Google Chrome on Windows prior to 149.0.7827.53 allowed a local attacker to perform OS-level privilege escalation via a malicious file. (Chromium security severity: Medium)
CVECVE-2026-11103
SeverityHIGH
TypeUPDATED
PublishedThu, Jun 04 · 11:17 PM CDT
ModifiedSat, Jun 06 · 01:16 PM CDT
CVE-2026-11435
7.3/10 · Worth your timeNVDvuln
Summary
A security vulnerability has been detected in Jinher OA 1.0. This affects an unknown function of the file nextselectplan.aspx. Such manipulation of the argument httpOID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early ab
CVECVE-2026-11435
SeverityHIGH
TypeNEW
PublishedSat, Jun 06 · 04:16 PM CDT
ModifiedSat, Jun 06 · 04:16 PM CDT
CVE-2026-11437
7.3/10 · Worth your timeNVDvuln
Summary
A flaw has been found in perfree go-fastdfs-web up to 1.3.7. Affected is the function checkServer of the file /install/checkServer of the component Installation Endpoint. Executing a manipulation can lead to server-side request forgery. The attack can be executed remotely. The exploit has been published and may be used
CVECVE-2026-11437
SeverityHIGH
TypeNEW
PublishedSat, Jun 06 · 05:16 PM CDT
ModifiedSat, Jun 06 · 05:16 PM CDT
CVE-2026-11450
7.3/10 · Worth your timeNVDvuln
Summary
A vulnerability was detected in GL.iNet GL-MT3000 4.4.5. This affects the function dlopen in the library /usr/lib/oui-httpd/rpc/ of the component Path Normalization Handler. Performing a manipulation of the argument dev_name results in command injection. It is possible to initiate the attack remotely. Upgrading to vers
CVECVE-2026-11450
SeverityHIGH
TypeNEW
PublishedSun, Jun 07 · 03:16 AM CDT
ModifiedSun, Jun 07 · 03:16 AM CDT
CVE-2026-11451
7.3/10 · Worth your timeNVDvuln
Summary
A flaw has been found in GL.iNet GL-MT3000 4.4.5. This impacts the function snprintf of the file /cgi-bin/glc of the component FTP Protocol Handler. Executing a manipulation of the argument media_dir can lead to command injection. It is possible to launch the attack remotely. Upgrading to version 4.8.1 will fix this is
CVECVE-2026-11451
SeverityHIGH
TypeNEW
PublishedSun, Jun 07 · 04:16 AM CDT
ModifiedSun, Jun 07 · 04:16 AM CDT
CVE-2026-11452
7.3/10 · Worth your timeNVDvuln
Summary
A vulnerability has been found in GL.iNet GL-MT3000 up to 4.4.5. Affected is the function FUN_0042e200 of the file /cgi-bin/glc of the component SET_USER_PWD Handler. The manipulation of the argument Password leads to command injection. The attack can be initiated remotely. Upgrading to version 4.8.1 is able to address
CVECVE-2026-11452
SeverityHIGH
TypeNEW
PublishedSun, Jun 07 · 04:16 AM CDT
ModifiedSun, Jun 07 · 04:16 AM CDT
CVE-2026-11456
7.3/10 · Worth your timeNVDvuln
Summary
A vulnerability was identified in Chanjet CRM 1.0. This affects an unknown part of the file /tools/jxf_dump_systable.php of the component HTTP GET Request Handler. Such manipulation of the argument gblOrgID leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used.
CVECVE-2026-11456
SeverityHIGH
TypeNEW
PublishedSun, Jun 07 · 09:16 AM CDT
ModifiedSun, Jun 07 · 09:16 AM CDT
CVE-2026-11457
7.3/10 · Worth your timeNVDvuln
Summary
A security flaw has been discovered in erzhongxmu JeeWMS up to 141740afb2ba14d441c82a833d0a418d07ca2d69. This vulnerability affects unknown code of the file /base-boot/jmreport/testConnection of the component JimuReport test-connection Endpoint. Performing a manipulation of the argument dbType/dbDriver/dbUrl/dbUsername
CVECVE-2026-11457
SeverityHIGH
TypeNEW
PublishedSun, Jun 07 · 09:16 AM CDT
ModifiedSun, Jun 07 · 09:16 AM CDT
CVE-2026-10992
6.5/10 · Skim only if relevantNVDvuln
Summary
Insufficient data validation in Animation in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
CVECVE-2026-10992
SeverityMEDIUM
TypeUPDATED
PublishedThu, Jun 04 · 11:17 PM CDT
ModifiedSat, Jun 06 · 05:16 PM CDT
CVE-2026-10993
6.5/10 · Skim only if relevantNVDvuln
Summary
Heap buffer overflow in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
CVECVE-2026-10993
SeverityMEDIUM
TypeUPDATED
PublishedThu, Jun 04 · 11:17 PM CDT
ModifiedSat, Jun 06 · 05:16 PM CDT
CVE-2026-10994
6.5/10 · Skim only if relevantNVDvuln
Summary
Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
CVECVE-2026-10994
SeverityMEDIUM
TypeUPDATED
PublishedThu, Jun 04 · 11:17 PM CDT
ModifiedSat, Jun 06 · 05:16 PM CDT
CVE-2026-10999
6.5/10 · Skim only if relevantNVDvuln
Summary
Integer overflow in ANGLE in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
CVECVE-2026-10999
SeverityMEDIUM
TypeUPDATED
PublishedThu, Jun 04 · 11:17 PM CDT
ModifiedSat, Jun 06 · 05:16 PM CDT
CVE-2026-11001
6.5/10 · Skim only if relevantNVDvuln
Summary
Inappropriate implementation in Payments in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
CVECVE-2026-11001
SeverityMEDIUM
TypeUPDATED
PublishedThu, Jun 04 · 11:17 PM CDT
ModifiedSat, Jun 06 · 05:16 PM CDT
CVE-2026-11006
6.5/10 · Skim only if relevantNVDvuln
Summary
Out of bounds read in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Medium)
CVECVE-2026-11006
SeverityMEDIUM
TypeUPDATED
PublishedThu, Jun 04 · 11:17 PM CDT
ModifiedSat, Jun 06 · 06:16 PM CDT
CVE-2026-36499
6.5/10 · Skim only if relevantNVDvuln
Summary
A missing upper-bound check in the udpif_set_threads() function of Open vSwitch v3.6.90 allows an attacker with OVSDB write access to request an excessive number of handler or revalidation threads. This can cause a denial of service (DoS) via resource exhaustion.
CVECVE-2026-36499
SeverityMEDIUM
TypeUPDATED
PublishedThu, Jun 04 · 07:16 PM CDT
ModifiedSat, Jun 06 · 08:16 PM CDT
