Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
10692
Total
727
Critical
3080
High
3407
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-6302 | HIGH | 8.8 | Use after free in Video in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted … | Apr 15, 2026 |
| CVE-2026-6301 | HIGH | 8.8 | Type Confusion in Turbofan in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML … | Apr 15, 2026 |
| CVE-2026-6300 | HIGH | 8.8 | Use after free in CSS in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted … | Apr 15, 2026 |
| CVE-2026-6299 | HIGH | 8.8 | Use after free in Prerender in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium … | Apr 15, 2026 |
| CVE-2026-6298 | MEDIUM | 4.3 | Heap buffer overflow in Skia in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to obtain potentially sensitive information from process memory via a … | Apr 15, 2026 |
| CVE-2026-6297 | HIGH | 8.3 | Use after free in Proxy in Google Chrome prior to 147.0.7727.101 allowed an attacker in a privileged network position to potentially perform a sandbox escape … | Apr 15, 2026 |
| CVE-2026-6296 | CRITICAL | 9.6 | Heap buffer overflow in ANGLE in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML … | Apr 15, 2026 |
| CVE-2026-40919 | MEDIUM | 6.1 | A flaw was found in GIMP. This vulnerability, a buffer overflow in the `file-seattle-filmworks` plugin, can be exploited when a user opens a specially crafted … | Apr 15, 2026 |
| CVE-2026-40918 | MEDIUM | 5.5 | A flaw was found in GIMP. Processing a specially crafted PVR image file with large dimensions can lead to a denial of service (DoS). This … | Apr 15, 2026 |
| CVE-2026-40917 | MEDIUM | 5.0 | A flaw was found in GIMP. This vulnerability, a heap buffer over-read in the `icns_slurp()` function, occurs when processing specially crafted ICNS image files. An … | Apr 15, 2026 |
| CVE-2026-40916 | MEDIUM | 5.0 | A flaw was found in GIMP. A stack buffer overflow vulnerability in the TIM image loader's 4BPP decoding path allows a local user to cause … | Apr 15, 2026 |
| CVE-2026-40915 | MEDIUM | 5.5 | A flaw was found in GIMP. A remote attacker could exploit an integer overflow vulnerability in the FITS image loader by providing a specially crafted … | Apr 15, 2026 |
| CVE-2026-39857 | MEDIUM | 5.3 | ApostropheCMS is an open-source Node.js content management system. Versions 4.28.0 and prior contain an authorization bypass vulnerability in the choices and counts query parameters of … | Apr 15, 2026 |
| CVE-2026-35569 | HIGH | 8.7 | ApostropheCMS is an open-source Node.js content management system. Versions 4.28.0 and prior contain a stored cross-site scripting vulnerability in SEO-related fields (SEO Title and Meta … | Apr 15, 2026 |
| CVE-2026-33889 | MEDIUM | 5.4 | ApostropheCMS is an open-source Node.js content management system. Versions 4.28.0 and prior contain a stored cross-site scripting vulnerability in the @apostrophecms/color-field module, where color values … | Apr 15, 2026 |
| CVE-2026-33888 | MEDIUM | 5.3 | ApostropheCMS is an open-source Node.js content management system. Versions 4.28.0 and prior contain an authorization bypass vulnerability in the getRestQuery method of the @apostrophecms/piece-type module, … | Apr 15, 2026 |
| CVE-2026-33877 | LOW | 3.7 | ApostropheCMS is an open-source Node.js content management system. Versions 4.28.0 and prior contain a timing side-channel vulnerability in the password reset endpoint (/api/v1/@apostrophecms/login/reset-request) that allows … | Apr 15, 2026 |
| CVE-2026-21727 | LOW | 3.3 | --- title: Cross-Tenant Legacy Correlation Disclosure and Deletion draft: false hero: image: /static/img/heros/hero-legal2.svg content: "# Cross-Tenant Legacy Correlation Disclosure and Deletion" date: 2026-01-29 product: Grafana … | Apr 15, 2026 |
| CVE-2026-21726 | MEDIUM | 5.3 | The CVE-2021-36156 fix validates the namespace parameter for path traversal sequences after a single URL decode, by double encoding, an attacker can read files at … | Apr 15, 2026 |
| CVE-2025-41118 | CRITICAL | 9.1 | Pyroscope is an open-source continuous profiling database. The database supports various storage backends, including Tencent Cloud Object Storage (COS). If the database is configured to … | Apr 15, 2026 |
| CVE-2026-6383 | MEDIUM | 5.4 | A flaw was found in KubeVirt's Role-Based Access Control (RBAC) evaluation logic. The authorization mechanism improperly truncates subresource names, leading to incorrect permission evaluations. This … | Apr 15, 2026 |
| CVE-2026-6245 | MEDIUM | 5.5 | A flaw was found in the System Security Services Daemon (SSSD). The pam_passkey_child_read_data() function within the PAM passkey responder fails to properly handle raw bytes … | Apr 15, 2026 |
| CVE-2026-5189 | UNKNOWN | — | CWE-798: Use of Hard-coded Credentials in Sonatype Nexus Repository Manager versions 3.0.0 through 3.70.5 allows an unauthenticated attacker with network access to gain unauthorized read/write … | Apr 15, 2026 |
| CVE-2026-4857 | HIGH | 8.4 | IdentityIQ 8.5, all IdentityIQ 8.5 patch levels prior to 8.5p2, IdentityIQ 8.4, and all IdentityIQ 8.4 patch levels prior to 8.4p4 allow authenticated users assigned … | Apr 15, 2026 |
| CVE-2026-40256 | MEDIUM | 5.0 | Weblate is a web based localization tool. In versions prior to 5.17, repository-boundary validation relies on string prefix checks on resolved absolute paths. In multiple … | Apr 15, 2026 |