Total
400129 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-62354 | 1 Apache | 1 Nifi | 2026-08-10 | N/A | 4.3 MEDIUM |
| Authorization handling for Parameter Context validation requests in Apache NiFi 1.10.0 through 2.10.0 allows clients with read access to submit proposed Parameter values. The proposed values override current configuration, enabling users with read access to invoke predefined component validation methods with alternative settings. Apache NiFi installations that do not implement different levels of authorization for viewing and modifying Parameter Context configuration are not subject to this vulnerability. Upgrading to Apache NiFi 2.11.0 is the recommended mitigation, requiring write access to submit Parameter Context validation requests. | |||||
| CVE-2026-62391 | 1 Apache | 1 Kyuubi | 2026-08-10 | N/A | 8.1 HIGH |
| The security fix for CVE-2025-66518 is incomplete. Any client who can access to Apache Kyuubi Server via Kyuubi frontend protocols can bypass server-side config kyuubi.session.local.dir.allowlist via unprefixed Spark config aliases. This issue affects Apache Kyuubi: from 1.6.0 before 1.12.0. Users are recommended to upgrade to version 1.12.0, which fixes the issue. | |||||
| CVE-2026-44615 | 1 Apache | 1 Zeppelin | 2026-08-10 | N/A | 6.5 MEDIUM |
| Path traversal vulnerability in Apache Zeppelin. When FileSystemNotebookRepo is configured, an authenticated attacker with permission to rename a note, or access to folder operations, could supply traversal segments in note or folder paths. Zeppelin composed these values into filesystem paths using the server's filesystem or Hadoop identity without ensuring that the result remained under the configured notebook directory. This could allow notebook files or directories to be moved, written, or deleted outside the notebook root. This issue affects Apache Zeppelin versions 0.9.0 through 0.12.0. Users are recommended to upgrade to version 0.12.1, which fixes this issue. | |||||
| CVE-2026-66756 | 1 Apache | 1 Tika | 2026-08-10 | N/A | 9.8 CRITICAL |
| Improper Protection of Alternate Path vulnerability in Apache Tika. This issue affects Apache Tika: from 4.0.0-alpha-1 before 4.0.0-beta-1. Users are recommended to upgrade to version 4.0.0-beta-1, which fixes the issue. | |||||
| CVE-2026-17913 | 2 Apple, Google | 2 Iphone Os, Chrome | 2026-08-10 | N/A | 5.4 MEDIUM |
| Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low) | |||||
| CVE-2026-17749 | 1 Google | 1 Chrome | 2026-08-10 | N/A | 9.6 CRITICAL |
| Insufficient validation of untrusted input in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape via a crafted Chrome Extension. (Chromium security severity: Medium) | |||||
| CVE-2026-17748 | 1 Google | 1 Chrome | 2026-08-10 | N/A | 6.5 MEDIUM |
| Inappropriate implementation in Extensions in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-17743 | 1 Google | 1 Chrome | 2026-08-10 | N/A | 6.5 MEDIUM |
| Insufficient policy enforcement in ControlledFrame in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-17738 | 1 Google | 1 Chrome | 2026-08-10 | N/A | 9.6 CRITICAL |
| Insufficient validation of untrusted input in Payments in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-17735 | 1 Google | 1 Chrome | 2026-08-10 | N/A | 8.7 HIGH |
| Insufficient validation of untrusted input in BFCache in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-17734 | 1 Google | 1 Chrome | 2026-08-10 | N/A | 5.4 MEDIUM |
| Inappropriate implementation in Autofill in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-17729 | 1 Google | 1 Chrome | 2026-08-10 | N/A | 8.8 HIGH |
| Use after free in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-17728 | 1 Google | 1 Chrome | 2026-08-10 | N/A | 5.4 MEDIUM |
| Inappropriate implementation in Extensions in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-17724 | 2 Apple, Google | 2 Iphone Os, Chrome | 2026-08-10 | N/A | 4.2 MEDIUM |
| Race in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: High) | |||||
| CVE-2026-17723 | 2 Google, Microsoft | 2 Chrome, Windows | 2026-08-10 | N/A | 8.3 HIGH |
| Use after free in Media in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) | |||||
| CVE-2026-17716 | 2 Apple, Google | 2 Macos, Chrome | 2026-08-10 | N/A | 8.4 HIGH |
| Use after free in Updater in Google Chrome on Mac prior to 151.0.7922.72 allowed a local attacker to perform privilege escalation via malicious network traffic. (Chromium security severity: High) | |||||
| CVE-2026-17706 | 2 Google, Microsoft | 2 Chrome, Windows | 2026-08-10 | N/A | 4.3 MEDIUM |
| Insufficient validation of untrusted input in Media in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High) | |||||
| CVE-2026-17674 | 1 Google | 1 Chrome | 2026-08-10 | N/A | 6.5 MEDIUM |
| Inappropriate implementation in HTML in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium security severity: High) | |||||
| CVE-2026-17664 | 1 Google | 1 Chrome | 2026-08-10 | N/A | 6.5 MEDIUM |
| Insufficient validation of untrusted input in Loader in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High) | |||||
| CVE-2026-17662 | 1 Google | 1 Chrome | 2026-08-10 | N/A | 4.3 MEDIUM |
| Insufficient policy enforcement in Prefetch in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High) | |||||