2026

Use after free in Passwords in Google Chrome on Android prior to 149.0.7827.155 allowed a remote attacker to execute arb

Use after free in File Input in Google Chrome on Linux prior to 149.0.7827.155 allowed a remote attacker to potentially

Use after free in DigitalCredentials in Google Chrome on Windows prior to 149.0.7827.155 allowed a remote attacker to po

Use after free in Digital Credentials in Google Chrome prior to 149.0.7827.155 allowed a remote attacker to potentially

Inappropriate implementation in WebView in Google Chrome on Android prior to 149.0.7827.155 allowed a remote attacker wh

Use after free in WebShare in Google Chrome on Windows prior to 149.0.7827.155 allowed a remote attacker who had comprom

The JetEngine plugin for WordPress is vulnerable to SQL injection in all versions up to and including 3.8.10.1. The list

Contributor PHP Object Injection in Avada <= 3.15.3 versions.

A vulnerability in `nltk.app.wordnet_app` up to version 3.9.3 allows unauthenticated remote shutdown of the local WordNe

The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to Privi

The Counter Box – Add Countdowns, Timers & Dynamic Counters to WordPress plugin for WordPress is vulnerable to PHP Objec

Stored cross-site scripting (XSS) in NewsItemApiController In SimplCommerce prior to commit 6142d3b5 allows an authentic

Quanos SCHEMA ST4 on-premises contains a local privilege escalation vulnerability in the Client Update Service. The upda

Quanos SCHEMA ST4 on-premises contains a local privilege escalation vulnerability in the Client Update Service due to in

An authenticated OS command injection vulnerability exists in the BigPond Cable (BPA) WAN configuration module in TL-WR9

An authenticated OS command injection vulnerability exists in the IPv6 PPPoE configuration handler in TL-WR940N v6 due t

Open redirection vulnerability in the authentication system allows an attacker to use manipulated values in the X-Forwar

Open redirection vulnerability due to insufficient validation of the X-Forwarded-Host HTTP header. An attacker could cre

Improper handling of HTTP headers that allows a remote attacker to manipulate the value of the Host header using special

A Path Traversal vulnerability affecting SOLIDWORKS Visualize from SOLIDWORKS Desktop Release 2024 through SOLIDWORKS De

In Package Manager, there is a possible device lock controller bypass due to a missing permission check. This could lead

In Nfc::eventCallback() of Nfc.h, there is a possible use after free due to a race condition. This could lead to local e

In tryStartActivity of NfcDispatcher.java, there is a possible automatic special app access permission assignment due to

In NFC, there is a possible way to spoof an NFC event due to a missing permission check. This could lead to local escala

In SettingsLib, there is a possible missing permission check due to a logic error in the code. This could lead to local

In createSessionInternal of PackageInstallerService.java, there is a possible method to remove a DPC app from a managed

In multiple places, there is a possible persistent denial of service due to resource exhaustion. This could lead to loca

In setAllowedCarriers of PhoneInterfaceManager.java, there is a possible way to disable carrier restrictions due to a lo

In Contacts Provider, there is a possible way to access an incoming call's phone number and associated metadata due to a

In SettingsLib, there is a possible way to disable system components due to a logic error in the code. This could lead t

Unauthenticated Privilege Escalation in Support Ticket Management System <= 1.9 versions.

Unauthenticated Local File Inclusion in Truemag <= 4.3.14.2 versions.

Unauthenticated Local File Inclusion in Roneous <= 2.1.5 versions.

Unauthenticated Local File Inclusion in ITactics <= 1.0 versions.

Unauthenticated Local File Inclusion in Tipsy <= 1.1 versions.

Unauthenticated Local File Inclusion in Resurs <= 1.3 versions.

Unauthenticated Local File Inclusion in Orpheus <= 1.3 versions.

Unauthenticated Local File Inclusion in Spike <= 1.2 versions.

Unauthenticated Local File Inclusion in Eros <= 1.3 versions.

Unauthenticated Local File Inclusion in Choreo <= 1.6 versions.

Unauthenticated Local File Inclusion in WineShop <= 3.17 versions.

Unauthenticated Local File Inclusion in Grecko <= 5.17 versions.

Unauthenticated Local File Inclusion in Snowy <= 1.13 versions.

Unauthenticated Local File Inclusion in Gita <= 1.11 versions.

Unauthenticated Local File Inclusion in Printo <= 1.11 versions.

Unauthenticated Cross Site Scripting (XSS) in Grand Car Rental <= 3.7 versions.

Unauthenticated Local File Inclusion in Medeus <= 1.14 versions.

Unauthenticated Local File Inclusion in Top Dog <= 1.0.5 versions.

Unauthenticated Local File Inclusion in Quirky <= 1.23 versions.

Unauthenticated Local File Inclusion in Putter <= 1.17 versions.