Total
864 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-54605 | 2026-10-23 | N/A | 7.2 HIGH | ||
| OAuth is a Ruby wrapper for the OAuth 1.0 and 1.0a protocols, providing clients and servers. From 0.5.5 to 1.1.5, OAuth::Consumer#token_request parses the raw Location header of a 300 to 399 redirect returned by the OAuth server and follows the redirect recursively, which can mutate the consumer's configuration and expose signed OAuth request metadata, including the Authorization header, to a cross-origin host. This issue is fixed in version 1.1.6. | |||||
| CVE-2026-17880 | 1 Google | 1 Chrome | 2026-10-23 | N/A | 4.3 MEDIUM |
| Inappropriate implementation in Autofill in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-66318 | 1 Microsoft | 1 Edge Chromium | 2026-10-23 | N/A | 8.1 HIGH |
| Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network. | |||||
| CVE-2026-17833 | 1 Google | 1 Chrome | 2026-10-23 | N/A | 4.3 MEDIUM |
| Inappropriate implementation in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-17850 | 1 Google | 1 Chrome | 2026-10-23 | N/A | 6.5 MEDIUM |
| Inappropriate implementation in Permissions in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-17820 | 1 Google | 1 Chrome | 2026-10-23 | N/A | 4.3 MEDIUM |
| Insufficient policy enforcement in Autofill in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-66322 | 1 Microsoft | 1 Edge Chromium | 2026-10-23 | N/A | 7.1 HIGH |
| Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. | |||||
| CVE-2026-17765 | 1 Google | 1 Chrome | 2026-10-23 | N/A | 4.3 MEDIUM |
| Inappropriate implementation in WebProtect in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-17876 | 1 Google | 1 Chrome | 2026-10-23 | N/A | 4.3 MEDIUM |
| Inappropriate implementation in Payments in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-17788 | 1 Google | 1 Chrome | 2026-10-23 | N/A | 4.3 MEDIUM |
| Inappropriate implementation in Blink in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-17857 | 1 Google | 1 Chrome | 2026-10-23 | N/A | 4.3 MEDIUM |
| Inappropriate implementation in Network in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-17823 | 1 Google | 1 Chrome | 2026-10-23 | N/A | 6.5 MEDIUM |
| Insufficient policy enforcement in WebXR in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-17879 | 1 Google | 1 Chrome | 2026-10-23 | N/A | 4.3 MEDIUM |
| Inappropriate implementation in Autofill in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-17854 | 1 Google | 1 Chrome | 2026-10-23 | N/A | 6.5 MEDIUM |
| Insufficient policy enforcement in WebMCP in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-17885 | 1 Google | 1 Chrome | 2026-10-23 | N/A | 4.3 MEDIUM |
| Inappropriate implementation in Paint in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-17817 | 1 Google | 1 Chrome | 2026-10-23 | N/A | 4.3 MEDIUM |
| Inappropriate implementation in ReportingAndNEL in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-17852 | 1 Google | 1 Chrome | 2026-10-23 | N/A | 6.5 MEDIUM |
| Inappropriate implementation in Media Router in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-17829 | 1 Google | 1 Chrome | 2026-10-23 | N/A | 4.3 MEDIUM |
| Insufficient policy enforcement in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-17843 | 1 Google | 1 Chrome | 2026-10-23 | N/A | 4.3 MEDIUM |
| Inappropriate implementation in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-17895 | 1 Google | 1 Chrome | 2026-10-23 | N/A | 4.3 MEDIUM |
| Inappropriate implementation in DataTransfer in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium) | |||||