Total
11780 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-79146 | 1 Google | 2 Android, Chrome | 2026-08-31 | N/A | 5.5 MEDIUM |
| Information leak in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker to obtain cross-origin data via a co-installed app. (Chromium security severity: Medium) | |||||
| CVE-2026-78960 | 1 Google | 1 Chrome | 2026-08-31 | N/A | 6.5 MEDIUM |
| Information leak in Extensions in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to obtain cross-origin data via a crafted Chrome extension. (Chromium security severity: Medium) | |||||
| CVE-2026-79075 | 1 Google | 1 Chrome | 2026-08-31 | N/A | 6.5 MEDIUM |
| Information leak in Geolocation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-81732 | 2026-08-29 | N/A | N/A | ||
| WWBN AVideo through version 30.0 fails to enforce authentication on the report4.json.php and report4.1.json.php endpoints, allowing unauthenticated access to user registration statistics. Attackers can send GET requests to these endpoints to retrieve daily and cumulative user-registration counts without any session or authorization. | |||||
| CVE-2026-79074 | 1 Google | 1 Chrome | 2026-08-28 | N/A | 5.3 MEDIUM |
| Information leak in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-78174 | 2026-08-28 | N/A | N/A | ||
| WatchGuard Dimension records unredacted session identifiers for logged-in users in its web UI diagnostic log. A low-privileged Dimension Administrator can retrieve this log and extract a Super Administrator's session token while that administrator is logged in, enabling account takeover. | |||||
| CVE-2026-78138 | 2026-08-28 | N/A | 4.3 MEDIUM | ||
| The Finale Lite WordPress plugin before 2.21.0 does not perform a capability check on an AJAX action that returns a sales-campaign's configuration for an arbitrary post ID, allowing any authenticated user (Subscriber and above) to read the Finale Lite WordPress plugin before 2.21.0's campaign configuration and scheduling data. | |||||
| CVE-2026-19715 | 2026-08-28 | N/A | 7.5 HIGH | ||
| The WP OAuth Server ( Login with WordPress ) WordPress plugin before 6.3.1 does not restrict access to the debug log it writes, which is stored at a fixed and publicly reachable location, allowing unauthenticated users to read the OAuth tokens and authorisation codes it has issued as well as user records including password hashes when debug logging is enabled. | |||||
| CVE-2026-77017 | 2026-08-28 | N/A | 7.7 HIGH | ||
| The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor confine the stored file location to an allowed directory before serving it, allowing users with a role as low as subscriber to read arbitrary files on the server, including its configuration file and authentication secrets. | |||||
| CVE-2026-78125 | 2026-08-28 | N/A | 5.3 MEDIUM | ||
| The LearnPress WordPress plugin before 4.0.3 does not perform any authorization check on one of its REST endpoints in all versions up to, and including, 4.0.2, allowing unauthenticated attackers to disclose the payment status of arbitrary orders by enumerating order identifiers. | |||||
| CVE-2026-14567 | 2026-08-28 | N/A | 5.3 MEDIUM | ||
| The User Frontend WordPress plugin before 4.3.10 does not restrict access to its user directory search endpoint, allowing unauthenticated attackers to retrieve the email address and phone number of every registered user, including administrators. | |||||
| CVE-2026-78895 | 1 Google | 1 Chrome | 2026-08-28 | N/A | 4.3 MEDIUM |
| Information leak in Paint in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High) | |||||
| CVE-2026-78908 | 1 Google | 1 Chrome | 2026-08-28 | N/A | 4.3 MEDIUM |
| Information leak in Canvas in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High) | |||||
| CVE-2026-79095 | 1 Google | 1 Chrome | 2026-08-28 | N/A | 4.3 MEDIUM |
| Information leak in Payments in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-79185 | 1 Google | 1 Chrome | 2026-08-28 | N/A | 4.3 MEDIUM |
| Information leak in DOM in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-79220 | 1 Google | 1 Chrome | 2026-08-28 | N/A | 5.3 MEDIUM |
| Information leak in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-79246 | 1 Google | 1 Chrome | 2026-08-28 | N/A | 6.5 MEDIUM |
| Information leak in DataTransfer in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low) | |||||
| CVE-2026-79252 | 1 Google | 1 Chrome | 2026-08-28 | N/A | 4.3 MEDIUM |
| Information leak in ServiceWorker in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-78987 | 1 Google | 1 Chrome | 2026-08-28 | N/A | 4.3 MEDIUM |
| Information leak in Canvas in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-48001 | 1 Adobe | 4 Commerce, Commerce B2b, I\/o Events and 1 more | 2026-08-28 | N/A | 3.7 LOW |
| Adobe Commerce is affected by an Information Exposure vulnerability that could lead to a limited disclosure of sensitive information. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction. | |||||