Total
13728 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-16641 | 2026-08-28 | N/A | 9.8 CRITICAL | ||
| Vulnerability in Drupal Commerce Elavon. This issue affects Commerce Elavon versions: *.*. | |||||
| CVE-2026-16643 | 2026-08-28 | N/A | 5.7 MEDIUM | ||
| Vulnerability in Drupal Lunr exposed filters. This issue affects Lunr exposed filters versions: *.*. | |||||
| CVE-2026-15088 | 2026-08-28 | N/A | 5.7 MEDIUM | ||
| Vulnerability in Drupal Development Environment. This issue affects Development Environment versions: *.*. | |||||
| CVE-2026-16642 | 2026-08-28 | N/A | 5.7 MEDIUM | ||
| Vulnerability in Drupal Email Login OTP. This issue affects Email Login OTP versions: *.*. | |||||
| CVE-2026-18261 | 2026-08-28 | N/A | 5.7 MEDIUM | ||
| Vulnerability in Drupal Powerful Surveys. This issue affects Powerful Surveys versions: *.*. | |||||
| CVE-2026-81827 | 2026-08-28 | N/A | N/A | ||
| Affected versions of Flowintel incorrectly attempted to validate login email addresses by calling Email(email). That does not perform WTForms field validation; it merely constructs a validator object. Consequently, malformed attacker-controlled email input could continue through the login process and be written to security-relevant logs. The vulnerable code inserted the supplied email into both a warning log and the custom audit logger. Since CR/LF characters were not escaped, an unauthenticated attacker could potentially inject additional physical log lines or forge misleading log entries. The patch corrects the validation call to Email()(form, form.email), changes the standard logging call to parameterized logging, and introduces _sanitize_log_fragment() so carriage returns and line feeds are encoded instead of creating new records. Version impacted >=3.3.0 | |||||
| CVE-2026-81662 | 2026-08-28 | N/A | N/A | ||
| Affected versions of Flowintel improperly trust configuration keys supplied to the alerts settings update endpoint. While configuration values were normalized to Python literals, the corresponding keys were used directly when constructing and replacing lines in conf/config_module.py. The vulnerable code used requester-controlled keys in both the regular expression and the generated assignment: f'{key} = {py_val}' and appended an assignment if the key was not already present. The modified Python configuration module was subsequently reloaded using importlib.reload(). This creates a code-generation boundary in which specially crafted configuration keys can alter the Python source structure and result in execution of attacker-controlled Python statements. Version impacted >=3.3.0 | |||||
| CVE-2026-78980 | 1 Google | 1 Chrome | 2026-08-28 | N/A | 4.3 MEDIUM |
| Improper input validation in ReaderMode in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass web origin policy into a privileged page via a crafted HTML page. (Chromium security severity: Low) | |||||
| CVE-2026-79000 | 1 Google | 1 Chrome | 2026-08-28 | N/A | 4.3 MEDIUM |
| Improper input validation in DeviceBoundSessionCredentials in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass web origin policy via crafted network traffic. (Chromium security severity: Low) | |||||
| CVE-2026-79015 | 1 Google | 1 Chrome | 2026-08-28 | N/A | 4.3 MEDIUM |
| Improper input validation in ServiceWorker in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low) | |||||
| CVE-2026-79105 | 2 Apple, Google | 2 Iphone Os, Chrome | 2026-08-28 | N/A | 4.3 MEDIUM |
| Improper input validation in Mobile in Google Chrome on on iOS prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low) | |||||
| CVE-2026-79192 | 1 Google | 1 Chrome | 2026-08-28 | N/A | 4.3 MEDIUM |
| Improper input validation in Variations in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially bypass web origin policy via crafted network traffic. (Chromium security severity: Medium) | |||||
| CVE-2026-79203 | 1 Google | 1 Chrome | 2026-08-28 | N/A | 3.1 LOW |
| Improper input validation in DevTools in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-79214 | 1 Google | 1 Chrome | 2026-08-28 | N/A | 4.3 MEDIUM |
| Improper input validation in Preload in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-79251 | 1 Google | 1 Chrome | 2026-08-28 | N/A | 4.3 MEDIUM |
| Improper input validation in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-79255 | 1 Google | 1 Chrome | 2026-08-28 | N/A | 3.1 LOW |
| Improper input validation in WebRTC in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-78976 | 1 Google | 1 Chrome | 2026-08-28 | N/A | 4.3 MEDIUM |
| Improper input validation in StorageAccessAPI in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-20901 | 1 Intel | 188 Xeon Bronze 3408u, Xeon Bronze 3408u Firmware, Xeon Bronze 3508u and 185 more | 2026-08-28 | N/A | 5.3 MEDIUM |
| Improper input validation for some Intel(R) Xeon(R) processors within firmware may allow an escalation of privilege. Startup code and smm adversary with a privileged user combined with a high complexity attack may enable data alteration. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (high) and availability (none) impacts. | |||||
| CVE-2026-71390 | 1 Adobe | 3 C2pa, C2pa-web, C2patool | 2026-08-28 | N/A | 4.0 MEDIUM |
| CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized limited write access. Exploitation of this issue does not require user interaction. | |||||
| CVE-2026-48436 | 1 Adobe | 3 C2pa, C2pa-web, C2patool | 2026-08-28 | N/A | 6.5 MEDIUM |
| CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. | |||||