Total
8762 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-14052 | 1 Google | 1 Chrome | 2026-10-25 | N/A | 4.3 MEDIUM |
| Insufficient policy enforcement in FileSystem in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass discretionary access control via a crafted HTML page. (Chromium security severity: Low) | |||||
| CVE-2026-13828 | 4 Apple, Google, Linux and 1 more | 4 Macos, Chrome, Linux Kernel and 1 more | 2026-10-25 | N/A | 6.5 MEDIUM |
| Inappropriate implementation in Enterprise in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High) | |||||
| CVE-2026-13932 | 1 Google | 2 Android, Chrome | 2026-10-25 | N/A | 6.5 MEDIUM |
| Inappropriate implementation in Sharing in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-14035 | 4 Apple, Google, Linux and 1 more | 4 Macos, Chrome, Linux Kernel and 1 more | 2026-10-25 | N/A | 6.5 MEDIUM |
| Insufficient policy enforcement in Bluetooth in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Low) | |||||
| CVE-2026-55114 | 1 Ui | 1 Unifi Network Application | 2026-10-25 | N/A | 8.8 HIGH |
| A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in UniFi Network Application to escalate privileges within the UniFi Network Application. | |||||
| CVE-2026-13897 | 1 Google | 1 Chrome | 2026-10-25 | N/A | 8.8 HIGH |
| Insufficient policy enforcement in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform privilege escalation via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-50746 | 1 Ui | 1 Unifi Connect Application | 2026-10-25 | N/A | 10.0 CRITICAL |
| A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Connect Application to execute a Command Injection on the host device. | |||||
| CVE-2026-54408 | 1 Ui | 1 Unifi Protect | 2026-10-25 | N/A | 8.6 HIGH |
| A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect Application to bypass authentication for data streaming. | |||||
| CVE-2026-41123 | 1 Dell | 1 Data Domain Operating System | 2026-10-25 | N/A | 4.3 MEDIUM |
| Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an improper access control vulnerability in the RBAC. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to information tampering. | |||||
| CVE-2026-13953 | 1 Google | 1 Chrome | 2026-10-25 | N/A | 6.5 MEDIUM |
| Inappropriate implementation in SplitView in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-13954 | 1 Google | 2 Android, Chrome | 2026-10-25 | N/A | 6.5 MEDIUM |
| Insufficient policy enforcement in XML in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-13864 | 1 Google | 1 Chrome | 2026-10-25 | N/A | 8.1 HIGH |
| Insufficient policy enforcement in WebHID in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extension to perform privilege escalation via a crafted Chrome Extension. (Chromium security severity: Medium) | |||||
| CVE-2026-14034 | 1 Google | 2 Android, Chrome | 2026-10-25 | N/A | 4.3 MEDIUM |
| Inappropriate implementation in WebXR in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low) | |||||
| CVE-2026-13568 | 2026-10-25 | 7.5 HIGH | 7.3 HIGH | ||
| A weakness has been identified in SourceCodester Inventory Management System 1.0. This vulnerability affects unknown code of the file /api/users_handler.php of the component User Registration Endpoint. This manipulation of the argument role causes improper access controls. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. | |||||
| CVE-2026-55118 | 1 Ui | 1 Unifi Network Application | 2026-10-25 | N/A | 8.3 HIGH |
| A malicious actor with access to the network,low privileges and under certain conditions could exploit an Improper Access Control vulnerability found in UniFi Network Application to escalate privileges within the UniFi Network Application. | |||||
| CVE-2026-13914 | 2 Apple, Google | 2 Macos, Chrome | 2026-10-25 | N/A | 5.5 MEDIUM |
| Inappropriate implementation in Passwords in Google Chrome on Mac prior to 150.0.7871.47 allowed a local attacker to obtain potentially sensitive information from process memory via a malicious file. (Chromium security severity: Medium) | |||||
| CVE-2026-50280 | 2026-10-25 | N/A | N/A | ||
| Craft CMS is a content management system (CMS). In versions 5.0.0-RC1 and above prior to 5.9.21, the EntriesController::actionMoveToSection() endpoint gates the destination section only by viewEntries:$section->uid rather than requiring saveEntries permission (the source entry is separately checked via Entry::canMove()). As a result, a low-privileged authenticated control-panel user who can move an entry out of its current section can call moveEntryToSection() to rewrite the entry's sectionId and save it into a section where they have read access but no write access. This breaks the section-level authorization model, letting a user with limited permissions inject content into a protected section and interfere with editorial boundaries, approval workflows, and section-specific business logic. This issue has been fixed in version 5.9.21. | |||||
| CVE-2026-55119 | 1 Ui | 1 Unifi Talk Application | 2026-10-25 | N/A | 8.1 HIGH |
| A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in UniFi Talk Application to escalate privileges within the UniFi Talk Application. | |||||
| CVE-2026-54407 | 1 Ui | 1 Unifi Protect | 2026-10-25 | N/A | 8.6 HIGH |
| A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect Application to bypass authentication in certain UniFi Protect Application API endpoints. | |||||
| CVE-2026-48956 | 1 Joomla | 1 Joomla\! | 2026-10-25 | N/A | 5.0 MEDIUM |
| An improper access check allows users to display a list of modules in the frontend. | |||||