Total
921 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-87636 | 1 Google | 1 Chrome | 2026-09-10 | N/A | 8.8 HIGH |
| Type confusion in XML in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-87612 | 1 Google | 1 Chrome | 2026-09-10 | N/A | 8.8 HIGH |
| Type confusion in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | |||||
| CVE-2026-87528 | 2 Google, Microsoft | 2 Chrome, Windows | 2026-09-10 | N/A | 9.6 CRITICAL |
| Type confusion in Rust in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-52829 | 2026-09-09 | N/A | 7.5 HIGH | ||
| ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, an unauthenticated IPv4 peer can deterministically terminate a synced Zebra node using the default Linux dual-stack listener configuration. The handshake path canonicalized an IPv4-mapped IPv6 PeerSocketAddr such as ::ffff:127.0.0.1 to plain IPv4 before storing it through MetaAddr::new_connected, but the mempool misbehavior path forwarded the raw transient address to MetaAddrChange::UpdateMisbehavior. In zebra-network/src/meta_addr.rs, apply_to_meta_addr then compared the canonical address-book entry with the raw update address and reached its unexpected address mismatch assertion. After the misbehavior batch flush, panic equals abort terminated zebrad; the peer only needed to complete a P2P handshake and advertise an invalid mempool transaction. This issue is fixed in version 4.5.0. | |||||
| CVE-2026-53600 | 2026-09-09 | N/A | N/A | ||
| async-tar is a tar archive reading/writing library for async Rust. Prior to version 0.6.1, async-tar mis-applies a buffered PAX size extension to an intermediary extension header (a GNU longname L, a GNU longlink K, or a PAX x/g header) instead of to the next file entry. POSIX requires a PAX extended-header record set to describe the next file entry, never an intervening extension header. Because poll_next_raw (src/archive.rs) threads the buffered PAX records into the size computation of whatever raw header it reads next — and that header can be an intermediary L — the stream cursor is advanced by an attacker-chosen amount when the L body is consumed. The parser then desyncs relative to a POSIX-correct tar parser (e.g. GNU tar), reading subsequent bytes at the wrong block boundary. This issue has been patched in version 0.6.1. | |||||
| CVE-2026-87564 | 1 Google | 1 Chrome | 2026-09-09 | N/A | 4.3 MEDIUM |
| Type confusion in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: High) | |||||
| CVE-2026-72938 | 1 Microsoft | 5 365 Apps, Microsoft 365, Office 2019 and 2 more | 2026-09-09 | N/A | 6.5 MEDIUM |
| Access of resource using incompatible type ('type confusion') in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network. | |||||
| CVE-2026-80183 | 2026-09-09 | N/A | N/A | ||
| In OpenStack Keystone before 29.0.3, any authenticated user holding role:reader on any project can list every project-scoped role assignment under any domain by passing a domain ID as scope.project.id with include_subtree to the GET /v3/role_assignments endpoint. The domain's project record has domain_id=null, causing the policy domain_id check to pass for any caller. With include_names, the response discloses the names and home-domain IDs of every user, group, project, and role involved. The literal "default" domain ID works against any deployment created with keystone-manage bootstrap. An attacker can harvest domain IDs from the response and repeat the query to map role assignments across the entire cloud. This is caused by misuse of "None" in list_role_assignments_for_tree. | |||||
| CVE-2026-69637 | 1 Microsoft | 7 Windows 10 1607, Windows 10 1809, Windows Server 2012 and 4 more | 2026-09-09 | N/A | 5.7 MEDIUM |
| Out-of-bounds read in Windows DHCP Server allows an authorized attacker to deny service over an adjacent network. | |||||
| CVE-2026-69679 | 1 Microsoft | 7 Windows 10 1607, Windows 10 1809, Windows Server 2012 and 4 more | 2026-09-09 | N/A | 5.7 MEDIUM |
| Out-of-bounds read in Windows DHCP Server allows an authorized attacker to deny service over an adjacent network. | |||||
| CVE-2026-81401 | 1 Microsoft | 8 365 Apps, Excel, Microsoft 365 and 5 more | 2026-09-09 | N/A | 5.5 MEDIUM |
| Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. | |||||
| CVE-2026-69717 | 2026-09-09 | N/A | 8.0 HIGH | ||
| Untrusted pointer dereference in Windows Group Policy allows an authorized attacker to elevate privileges over a network. | |||||
| CVE-2026-69324 | 2026-09-09 | N/A | 7.8 HIGH | ||
| Access of resource using incompatible type ('type confusion') in Windows Performance Monitor allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-70584 | 2026-09-09 | N/A | 7.8 HIGH | ||
| Access of resource using incompatible type ('type confusion') in Windows Core Messaging allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-69308 | 2026-09-08 | N/A | 5.5 MEDIUM | ||
| Out-of-bounds read in Microsoft Standard XPS allows an authorized attacker to disclose information locally. | |||||
| CVE-2026-82057 | 2026-09-08 | N/A | 6.5 MEDIUM | ||
| A security issue was discovered in MongoDB where an authenticated user with readWrite privileges could crash the mongod server process. By specifying a custom WiredTiger storage configuration option with an incompatible value during collection creation, a user could cause a type confusion in the storage engine layer. When documents were subsequently read from the misconfigured collection, the resulting mismatch in expected data format led to corrupted memory interpretation and a server crash. The crafted collection configuration persists across restarts, requiring manual operator intervention to remediate. | |||||
| CVE-2026-20508 | 2026-09-08 | N/A | 6.7 MEDIUM | ||
| In Power HAL, there is a possible escalation of privilege due to type confusion. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11165543; Issue ID: MSV-9012. | |||||
| CVE-2026-85051 | 1 Google | 1 Chrome | 2026-09-08 | N/A | 8.8 HIGH |
| Type confusion in Compositing in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | |||||
| CVE-2026-85046 | 1 Google | 2 Chrome, V8 | 2026-09-08 | N/A | 8.8 HIGH |
| Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | |||||
| CVE-2026-59304 | 1 Vmware | 1 Spring Cloud Stream | 2026-09-04 | N/A | 3.1 LOW |
| Improper caching of the original content type in Spring Cloud Stream Avro. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6 | |||||