Total
13727 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-17671 | 1 Google | 1 Chrome | 2026-10-24 | N/A | 9.6 CRITICAL |
| Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) | |||||
| CVE-2026-17761 | 2 Apple, Google | 2 Iphone Os, Chrome | 2026-10-24 | N/A | 5.4 MEDIUM |
| Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via malicious network traffic. (Chromium security severity: Medium) | |||||
| CVE-2026-17681 | 1 Google | 2 Android, Chrome | 2026-10-24 | N/A | 9.6 CRITICAL |
| Insufficient validation of untrusted input in Web Authentication in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) | |||||
| CVE-2026-16723 | 2026-10-24 | N/A | 9.0 CRITICAL | ||
| A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configuration — no AutoType enablement required, no classpath gadget required. | |||||
| CVE-2026-62828 | 1 Microsoft | 1 Edge | 2026-10-24 | N/A | 5.4 MEDIUM |
| Improper input validation in Microsoft Edge for Android allows an unauthorized attacker to perform tampering over a network. | |||||
| CVE-2026-17713 | 1 Google | 2 Android, Chrome | 2026-10-24 | N/A | 9.6 CRITICAL |
| Insufficient validation of untrusted input in Accessibility in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) | |||||
| CVE-2026-65604 | 2026-10-24 | N/A | 8.2 HIGH | ||
| Skipper contains an incomplete fix for CVE-2026-50197 in which oversized request bodies bypass Open Policy Agent (OPA) deny-on-presence Rego policies. When a request body exceeds the configured maxBodyBytes limit, Skipper forwards the full payload to the upstream service while OPA evaluates against an empty parsed_body, so policies that deny requests based on body content are not enforced and forbidden actions proceed. No fixed version is available; v0.27.26 adds documentation guidance only. | |||||
| CVE-2026-40712 | 1 Dell | 1 Powerprotect Data Manager | 2026-10-24 | N/A | 9.1 CRITICAL |
| Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) an Improper Input Validation vulnerability in the REST API. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges. | |||||
| CVE-2026-17741 | 1 Google | 2 Android, Chrome | 2026-10-24 | N/A | 7.1 HIGH |
| Insufficient validation of untrusted input in WebView in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-17686 | 1 Google | 1 Chrome | 2026-10-24 | N/A | 8.1 HIGH |
| Insufficient validation of untrusted input in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High) | |||||
| CVE-2026-17735 | 1 Google | 1 Chrome | 2026-10-24 | N/A | 8.7 HIGH |
| Insufficient validation of untrusted input in BFCache in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-54120 | 1 Microsoft | 1 Surface Management Services | 2026-10-24 | N/A | 9.9 CRITICAL |
| Improper input validation in Microsoft Surface allows an authorized attacker to execute code over a network. | |||||
| CVE-2026-43793 | 1 Apple | 1 Macos | 2026-10-24 | N/A | 9.8 CRITICAL |
| An issue existed in the handling of environment variables. This issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to cause unexpected system termination. | |||||
| CVE-2026-55973 | 1 Nlnetlabs | 1 Unbound | 2026-10-24 | N/A | 7.5 HIGH |
| In NLnet Labs Unbound 1.23.0 up to and including 1.25.1, when 'dns-error-reporting: yes' is set, the EDNS Report-Channel option (code 18) from the last upstream response is read and uses the option's length as the length of the agent domain. When a domain name check is performed on the agent domain, the returned lenght is not used and if the agent domain is followed by garbage, those bytes are moved onto the tail of the synthetic '_er.' report query name. That query name is later used in the iterator via a subquery to send out the DNS Error Report and when Unbound tries to walk that query name during 'find_closest_of_type()', it strips labels using the query name length rather than stopping at the embedded root, walks one byte past it, and feeds the first garbage byte to 'dname_query_hash()' as a label length writing over the stack variable 'labuf'. One ordinary upstream response from a delegated zone the attacker controls is sufficient to terminate the daemon. | |||||
| CVE-2026-46737 | 1 Dell | 1 Powerprotect Data Manager | 2026-10-24 | N/A | 6.7 MEDIUM |
| Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) an Improper Input Validation vulnerability in the REST API. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote execution. | |||||
| CVE-2026-17706 | 2 Google, Microsoft | 2 Chrome, Windows | 2026-10-24 | N/A | 4.3 MEDIUM |
| Insufficient validation of untrusted input in Media in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High) | |||||
| CVE-2026-17749 | 1 Google | 1 Chrome | 2026-10-24 | N/A | 9.6 CRITICAL |
| Insufficient validation of untrusted input in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape via a crafted Chrome Extension. (Chromium security severity: Medium) | |||||
| CVE-2026-46738 | 1 Dell | 1 Powerprotect Data Manager | 2026-10-24 | N/A | 9.1 CRITICAL |
| Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) an Improper Input Validation vulnerability in the REST API. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges. | |||||
| CVE-2026-17655 | 1 Google | 1 Chrome | 2026-10-24 | N/A | 9.6 CRITICAL |
| Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical) | |||||
| CVE-2026-17679 | 1 Google | 1 Chrome | 2026-10-24 | N/A | 6.5 MEDIUM |
| Insufficient validation of untrusted input in Print Preview in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High) | |||||