CVE ID: CVE-2026-10979 Severity: MEDIUM (CVSS 6.5) CWE: CWE-125 Affected: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Out of bounds read in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)


CVE ID: CVE-2021-40327 Severity: MEDIUM (CVSS 5.9) CWE: CWE-862 Affected: cpe:2.3:o:trustedfirmware:trusted_firmware-m:1.4.0:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Trusted Firmware-M (TF-M) 1.4.0, when Profile Small is used, has incorrect access control. NSPE can access a secure key (held by the Crypto service) based solely on knowledge of its key ID. For example, there is no authorization check associated with the relationship between a caller and a key owner.


CVE ID: CVE-2026-10980 Severity: MEDIUM (CVSS 6.5) CWE: CWE-20 Affected: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Insufficient validation of untrusted input in DevTools in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page. (Chromium security severity: High)


CVE ID: CVE-2026-10981 Severity: MEDIUM (CVSS 6.5) CWE: CWE-20 Affected: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Insufficient validation of untrusted input in Codecs in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted video file. (Chromium security severity: High)


CVE ID: CVE-2026-10934 Severity: HIGH (CVSS 8.3) CWE: CWE-416 Affected: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, cpe:2.3:o:google:android:-:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Use after free in Autofill in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)


CVE ID: CVE-2026-10933 Severity: HIGH (CVSS 8.3) CWE: CWE-416 Affected: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Use after free in Audio in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)


CVE ID: CVE-2026-10932 Severity: HIGH (CVSS 8.8) CWE: CWE-416 Affected: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, cpe:2.3:o:google:android:-:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Use after free in UI in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)


CVE ID: CVE-2026-5081 Severity: CRITICAL (CVSS 9.1) CWE: CWE-340 Affected: cpe:2.3:a:chorny:apache\:\:session\:\:generate\:\:moduniqueid:*:*:*:*:*:perl:*:* KEV (actively exploited): NO Description: Apache::Session::Generate::ModUniqueId versions from 1.54 through 1.94 for Perl session ids are insecure. Apache::Session::Generate::ModUniqueId (added in version 1.54) uses the value of the UNIQUE_ID environment variable for the session id. The UNIQUE_ID variable is set by the Apache mod_unique_id plugin, which generates unique ids for the request. The id is based on the IPv4 address, the process id, the epoch time, a 16-bit counter and a thread index, with no obfuscation. The server IP is often available to the public, and if not available, can be guessed from previous session ids being issued. The process ids may also be guessed from previous session ids. The timestamp is easily guessed (and leaked in the HTTP Date response header). The purpose of mod_unique_id is to assign a unique id to requests so that events can be correlated in different logs. The id is not designed, nor is it suitable for security purposes.


CVE ID: CVE-2026-11040 Severity: HIGH (CVSS 8.3) CWE: CWE-416 Affected: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Use after free in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)


CVE ID: CVE-2026-11061 Severity: CRITICAL (CVSS 9.6) CWE: CWE-125, CWE-416 Affected: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Type Confusion in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)


CVE ID: CVE-2026-11065 Severity: CRITICAL (CVSS 9.6) CWE: CWE-416 Affected: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Use after free in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)


CVE ID: CVE-2026-11066 Severity: CRITICAL (CVSS 9.6) CWE: CWE-20 Affected: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)


CVE ID: CVE-2026-11088 Severity: CRITICAL (CVSS 9.6) CWE: CWE-190, CWE-472 Affected: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Integer overflow in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)


CVE ID: CVE-2026-11095 Severity: CRITICAL (CVSS 9.6) CWE: CWE-20 Affected: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Insufficient validation of untrusted input in Codecs in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)


CVE ID: CVE-2026-11213 Severity: CRITICAL (CVSS 9.6) CWE: CWE-20 Affected: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*, cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Insufficient validation of untrusted input in Reading Mode in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)


CVE ID: CVE-2026-11214 Severity: MEDIUM (CVSS 6.5) CWE: CWE-346, CWE-352 Affected: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, cpe:2.3:o:apple:iphone_os:-:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)


CVE ID: CVE-2026-11215 Severity: MEDIUM (CVSS 6.5) CWE: CWE-451 Affected: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, cpe:2.3:o:google:android:-:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Inappropriate implementation in Cronet in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to perform domain spoofing via a crafted domain name. (Chromium security severity: Medium)


CVE ID: CVE-2026-11216 Severity: MEDIUM (CVSS 4.3) CWE: CWE-451 Affected: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*, cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Incorrect security UI in File Input in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)


CVE ID: CVE-2026-11217 Severity: MEDIUM (CVSS 6.5) CWE: CWE-346 Affected: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*, cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Inappropriate implementation in Fenced Frames in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Low)


CVE ID: CVE-2026-11218 Severity: MEDIUM (CVSS 6.8) CWE: CWE-20, CWE-94 Affected: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Inappropriate implementation in PlatformIntegration in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a malicious file. (Chromium security severity: Low)


CVE ID: CVE-2026-11219 Severity: MEDIUM (CVSS 4.3) CWE: CWE-693 Affected: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*, cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Inappropriate implementation in Navigation in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)


CVE ID: CVE-2026-11220 Severity: MEDIUM (CVSS 6.5) CWE: CWE-20 Affected: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*, cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Insufficient validation of untrusted input in Navigation in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Low)


CVE ID: CVE-2026-10937 Severity: MEDIUM (CVSS 6.5) CWE: CWE-346 Affected: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Inappropriate implementation in Passwords in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: High)


CVE ID: CVE-2026-10931 Severity: CRITICAL (CVSS 9.6) CWE: CWE-416 Affected: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Use after free in FileSystem in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)


CVE ID: CVE-2026-11221 Severity: MEDIUM (CVSS 4.3) CWE: CWE-20 Affected: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*, cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Insufficient validation of untrusted input in PointerLock in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)


CVE ID: CVE-2026-10930 Severity: HIGH (CVSS 8.1) CWE: CWE-125 Affected: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Out of bounds read in ANGLE in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High)


CVE ID: CVE-2022-46152 Severity: HIGH (CVSS 8.8) CWE: CWE-129 Affected: cpe:2.3:o:trustedfirmware:op-tee:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: OP-TEE Trusted OS is the secure side implementation of OP-TEE project, a Trusted Execution Environment. Versions prior to 3.19.0, contain an Improper Validation of Array Index vulnerability. The function `cleanup_shm_refs()` is called by both `entry_invoke_command()` and `entry_open_session()`. The commands `OPTEE_MSG_CMD_OPEN_SESSION` and `OPTEE_MSG_CMD_INVOKE_COMMAND` can be executed from the normal world via an OP-TEE SMC. This function is not validating the `num_params` argument, which is only limited to `OPTEE_MSG_MAX_NUM_PARAMS` (127) in the function `get_cmd_buffer()`. Therefore, an attacker in the normal world can craft an SMC call that will cause out-of-bounds reading in `cleanup_shm_refs` and potentially freeing of fake-objects in the function `mobj_put()`. A normal-world attacker with permission to execute SMC instructions may exploit this flaw. Maintainers believe this problem permits local privilege escalation from the normal world to the secure world. Version 3.19.0 contains a fix for this issue. There are no known workarounds.


CVE ID: CVE-2026-11222 Severity: MEDIUM (CVSS 6.5) CWE: CWE-451 Affected: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*, cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Incorrect security UI in Tab Strip in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform domain spoofing via a crafted HTML page. (Chromium security severity: Low)


CVE ID: CVE-2026-10974 Severity: CRITICAL (CVSS 9.6) CWE: CWE-20 Affected: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)


CVE ID: CVE-2016-6129 Severity: HIGH (CVSS 7.5) CWE: CWE-20 Affected: cpe:2.3:a:libtom:libtomcrypt:*:*:*:*:*:*:*:*, cpe:2.3:o:trustedfirmware:op-tee:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: The rsa_verify_hash_ex function in rsa_verify_hash.c in LibTomCrypt, as used in OP-TEE before 2.2.0, does not validate that the message length is equal to the ASN.1 encoded data length, which makes it easier for remote attackers to forge RSA signatures or public certificates by leveraging a Bleichenbacher signature forgery attack.


CVE ID: CVE-2026-11223 Severity: MEDIUM (CVSS 6.5) CWE: CWE-20 Affected: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*, cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Insufficient validation of untrusted input in Network in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page. (Chromium security severity: Low)


CVE ID: CVE-2026-10938 Severity: MEDIUM (CVSS 6.5) CWE: CWE-20 Affected: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Inappropriate implementation in Input in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High)


CVE ID: CVE-2026-45614 Severity: MEDIUM (CVSS 4.7) CWE: CWE-347 Affected: cpe:2.3:o:trustedfirmware:op-tee:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. Prior to version 4.11.0, on many of the ECDH shared secret paths, the public key isn't verified to be a point on the correct curve. By passing approximately 30-40 crafted public keys to OP-TEE, the private key can be reconstructed by a normal world attacker. When calling TEE_DeriveKey the public key is provided with full X and Y values, but the (X, Y) point might not satisfy the `Y^2 == X^3 + aX + b mod P` math for the specific curve that is used. When those public keys aren't rejected, the attacker can select public keys such that each DeriveKey call will leak `d % r` where `d` is the private key and `r` comes from the relationship between the correct curve and the attacker selected curve. With enough leaked data the Chinese remainder theorem can be used to recover the full private key. Version 4.11.0 fixes the issue.


CVE ID: CVE-2026-33662 Severity: HIGH (CVSS 7.5) CWE: CWE-190 Affected: cpe:2.3:o:trustedfirmware:op-tee:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. From 3.8.0 to 4.10, in the function emsa_pkcs1_v1_5_encode() in core/drivers/crypto/crypto_api/acipher/rsassa.c, the amount of padding needed, "PS size", is calculated by subtracting the size of the digest and other fields required for the EMA-PKCS1-v1_5 encoding from the size of the modulus of the key. By selecting a small enough modulus, this subtraction can overflow. The padding is added as a string of 0xFF bytes with a call to memset(), and an underflowed integer will cause the memset() call to overwrite until OP-TEE crashes. This only affects platforms registering RSA acceleration.


CVE ID: CVE-2026-33317 Severity: HIGH (CVSS 8.7) CWE: CWE-125, CWE-787 Affected: cpe:2.3:o:trustedfirmware:op-tee:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. In versions 3.13.0 through 4.10.0, missing checks in `entry_get_attribute_value()` in `ta/pkcs11/src/object.c` can lead to out-of-bounds read from the PKCS#11 TA heap or a crash. When chained with the OOB read, the PKCS#11 TA function `PKCS11_CMD_GET_ATTRIBUTE_VALUE` or `entry_get_attribute_value()` can, with a bad template parameter, be tricked into reading at most 7 bytes beyond the end of the template buffer and writing beyond the end of the template buffer with the content of an attribute value of a PKCS#11 object. Commits e031c4e562023fd9f199e39fd2e85797e4cbdca9, 16926d5a46934c46e6656246b4fc18385a246900, and 149e8d7ecc4ef8bb00ab4a37fd2ccede6d79e1ca contain patches and are anticipated to be part of version 4.11.0.


CVE ID: CVE-2026-40290 Severity: HIGH (CVSS 7.8) CWE: CWE-416 Affected: cpe:2.3:o:trustedfirmware:op-tee:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. Starting in version 3.16.0 and prior to 4.11.0, a user-after-free (UAF) race condition exists in the shared memory teardown logic of FF-A within OP-TEE SPMC/SP flows. This only applies when OP-TEE is configured as an SPMC for S-EL0 SPs, that is, with `CFG_SECURE_PARTITION=y`. The function `sp_mem_remove()`, responsible for freeing entries in `smem->receivers` and `smem->regions`, fails to acquire the global `sp_mem_lock` before performing the `free()` operations. Concurrently, other code paths, such as `sp_mem_get_receiver()`, iterate over these same lists without holding a lock, or, like `sp_mem_is_shared()`, iterate while holding the lock but are not serialized against the unprotected `free()` in `sp_mem_remove()`. This creates a cross-thread race where a thread iterating the list can acquire a pointer to an entry (e.g., `struct sp_mem_map_region` or `struct sp_mem_receiver`), and then another thread calls `sp_mem_remove()`, freeing the object. When the first thread resumes and dereferences the pointer, it results in a Use-After-Free vulnerability. Version 4.11.0 fixes the issue.


CVE ID: CVE-2026-10976 Severity: HIGH (CVSS 7.4) CWE: CWE-457 Affected: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Uninitialized Use in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)


CVE ID: CVE-2026-50733 Severity: HIGH (CVSS 8.6) CWE: CWE-95 KEV (actively exploited): NO Description: Markdown Preview Enhanced before 0.8.28 parses WaveDrom diagrams by evaluating untrusted markdown content with eval(), allowing arbitrary JavaScript execution. The flaw affects every render path - the live preview (window.eval) and presentation mode plus HTML export (the bundled WaveDrom.ProcessAll()/eva() helpers) - and can also be triggered through a element injected via raw HTML in markdown. When a victim previews or exports a crafted markdown document, an attacker can execute arbitrary code, leading to arbitrary file write. Fixed in 0.8.28 by parsing with JSON5.parse() and sanitizing WaveDrom data scripts to inert strict JSON.


CVE ID: CVE-2026-48104 Severity: MEDIUM (CVSS 4.2) CWE: CWE-125, CWE-908 KEV (actively exploited): NO Description: 7-Zip is a file archiver with a high compression ratio. Versions 9.18 through 26.00 contain an uninitialized heap read in the SquashFS archive handler caused by a sparsely populated index array. In the SquashFS handler, _blockToNode is allocated with capacity for every metadata block but populated only when an inode crosses a block boundary, so a crafted image with few inodes spanning many blocks leaves most slots holding raw heap contents (the underlying allocator does not zero-initialize POD storage). When OpenDir looks up an attacker-influenced blockIndex (derived from the RootInode superblock field), it reads two of these uninitialized slots and passes them as the left/right bounds of a binary search over _nodesPos, which dereferences the midpoint without bounds checking; if the resulting value happens to match the search key, the returned index is used to read a full node struct from _nodes whose fields feed further directory parsing, forming a chained OOB read primitive that is heap-layout-dependent and not reliably triggerable. The SquashFS handler is enabled by default in stock 7z.dll and the issue triggers during Open() with no interaction beyond opening the file; impact is denial of service from wild-pointer dereference and potential heap information disclosure, with no write primitive. Version 26.01 fixes the issue.


CVE ID: CVE-2026-46496 Severity: CRITICAL (CVSS 9.3) CWE: CWE-116, CWE-79 KEV (actively exploited): NO Description: HAX CMS helps manage microsite universe with PHP or NodeJs backends. A stored cross-site scripting (XSS) vulnerability exists in versions prior to 26.0.0 due to improper sanitization of the ` ` component. The component allows `javascript:` URIs in the `source` attribute, which are executed when the page is viewed. This enables attackers to execute arbitrary JavaScript in the context of the victim’s browser and access sensitive data such as JWT tokens and more. Version 26.0.0 fixes the issue.


CVE ID: CVE-2026-46395 Severity: CRITICAL (CVSS 9.3) CWE: CWE-200, CWE-321, CWE-327 KEV (actively exploited): NO Description: HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, the `hmacBase64()` function in the HAXcms Node.js backend contains two critical cryptographic implementation errors that together allow any unauthenticated attacker to extract the system’s private signing key and forge arbitrary admin-level JSON Web Tokens (JWTs) allowing them to get full admin access with a single HTTP request. First, the function passes the literal string "0" as the HMAC signing key instead of the key parameter, making every HAXcms instance compute identical HMACs for the same input. Then, after computing the HMAC, the function concatenates the real key parameter which is "this.privateKey + this.salt", the system’s master signing secret is directly onto the output. The combined buffer is base64-encoded and returned as the token. Every base64url token produced has the same structure: 32 bytes HMAC keyed with "0" and N bytes of `privateKey+salt`. An attacker base64-decodes any token, discards the first 32 bytes, and reads the private key directly. The `/system/api/connectionSettings` endpoint is unauthenticated and returns multiple tokens generated by this function. A single GET request to this endpoint exposes the private key. The PHP backend implements this function correctly with the actual key and returns only the hash. The PHP version produces 44-character tokens whereas the broken Node.js version produces 139+ character tokens. Version 26.0.0 fixes the issue.


CVE ID: CVE-2026-46392 Severity: HIGH (CVSS 8.7) CWE: CWE-178, CWE-434 KEV (actively exploited): NO Description: HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0 of HAX CMS PHP, the `saveFile` endpoint validates upload extensions case-insensitively and writes the filename to disk verbatim, but the `.htaccess` rule that forces `Content-Disposition: attachment` on HTML files is case-sensitive. An HTML file uploaded with an uppercase extension (`.HTML`, `.Html`, `.HTM`) is still served as `text/html` but the forced-download header never applies, so the browser renders it inline and executes any embedded JavaScript in the HAXcms origin. This bypasses the mitigation shipped for CVE-2026-22704. Version 26.0.0 contains a fix.


CVE ID: CVE-2026-45749 Severity: HIGH (CVSS 8.1) CWE: CWE-308 KEV (actively exploited): NO Description: Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. The `POST /users/totp/disable` and `POST /users/totp/backup-codes` endpoints in Termix prior to version 2.3.2 accept the account password as a sole authentication factor for MFA-critical operations. An attacker who obtains a user's password (phishing, credential stuffing, the passwordHash leak in GHSA-xxxx) can disable TOTP entirely or regenerate backup codes, without ever possessing the TOTP device or knowing a valid TOTP code. This renders two-factor authentication ineffective. Version 2.3.2 patches the issue.


CVE ID: CVE-2026-45745 Severity: HIGH (CVSS 8.0) CWE: CWE-295 KEV (actively exploited): NO Description: Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Starting in version 1.7.0, Termix Desktop (Electron) disables TLS certificate validation, allowing a machine-in-the-middle attacker to intercept and modify HTTPS traffic to the configured Termix server. This can lead to credential theft and JWT/session theft during login and normal use. As of time of publication, no known patched versions are available.


CVE ID: CVE-2026-42540 Severity: MEDIUM (CVSS 4.3) CWE: CWE-915 KEV (actively exploited): NO Description: IRIS is a web collaborative platform that helps incident responders share technical details during investigations. Versions prior to 2.4.28 allow a user to alter values in the database via manipulated API requests. Version 2.4.28 contains a patch.


CVE ID: CVE-2026-42538 Severity: MEDIUM (CVSS 6.3) CWE: CWE-434 KEV (actively exploited): NO Description: IRIS is a web collaborative platform that helps incident responders share technical details during investigations. Versions prior to 2.4.28 do not properly validate uploaded files. The application can therefore be misused to host phishing pages, amongst other things. This also creates another instance of a Cross-Site Scripting (XSS) vulnerability. Version 2.4.28 contains a patch.


CVE ID: CVE-2026-41518 Severity: HIGH (CVSS 7.6) CWE: CWE-79 KEV (actively exploited): NO Description: Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. In versions 4.9.0 through 5.0.0, an authenticated user with project-editor permissions can store arbitrary HTML/JavaScript in the `ChartDatasetConfig.legend` field. The payload is persisted verbatim in the database, propagated through the Chart.js rendering pipeline, and injected into the tooltip DOM element via an unguarded `innerHTML` assignment in `ChartTooltip.js`. Every unauthenticated viewer of the public dashboard triggers JavaScript execution on page load — no hover interaction is required. Browser-based Playwright verification confirmed `alert('localhost')` fires immediately and ` ` is present in the `#chartjs-tooltip` DOM element. Version 5.0.1 contains a fix.


CVE ID: CVE-2026-41237 Severity: HIGH (CVSS 8.6) CWE: CWE-74 KEV (actively exploited): NO Description: Froxlor is open source server administration software. In version 2.3.6 and earlier, the LOC record regex uses `\s+` which matches newlines (allowing embedded newlines to pass), TLSA `matchingType=0` has no upper bound on hex data length, and all validators return raw input without zone-file escaping. Version 2.3.7 contains an updated patch.


CVE ID: CVE-2026-11322 Severity: HIGH (CVSS 7.1) CWE: CWE-59 KEV (actively exploited): NO Description: Hermes WebUI prior to v0.51.221 contains a path traversal vulnerability that allows attackers to escape the workspace boundary by supplying symlinks that resolve to files or directories outside the designated workspace root. Attackers can exploit the workspace file and listing APIs, which resolve symlink targets without enforcing that the final path remains within the workspace, to read external host files accessible to the server process and disclose sensitive data such as SSH keys, cloud credentials, or application tokens.


CVE ID: CVE-2026-11295 Severity: HIGH (CVSS 8.8) CWE: CWE-269 KEV (actively exploited): NO Description: Inappropriate implementation in WebView in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to perform privilege escalation via a crafted HTML page. (Chromium security severity: Low)


CVE ID: CVE-2026-11294 Severity: MEDIUM (CVSS 4.3) CWE: CWE-451 KEV (actively exploited): NO Description: Inappropriate implementation in Passwords in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)


CVE ID: CVE-2026-11293 Severity: CRITICAL (CVSS 9.6) CWE: CWE-416 KEV (actively exploited): NO Description: Use after free in Input in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)


CVE ID: CVE-2026-11292 Severity: MEDIUM (CVSS 4.3) CWE: CWE-693 KEV (actively exploited): NO Description: Insufficient policy enforcement in Blink in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium security severity: Low)


CVE ID: CVE-2026-11291 Severity: MEDIUM (CVSS 4.3) CWE: CWE-346 KEV (actively exploited): NO Description: Inappropriate implementation in Android Autofill in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Low)


CVE ID: CVE-2026-11290 Severity: MEDIUM (CVSS 5.0) CWE: CWE-190, CWE-472 KEV (actively exploited): NO Description: Integer overflow in WebView in Google Chrome on Android prior to 149.0.7827.53 allowed a local attacker to cause a denial of service via a malicious file. (Chromium security severity: Low)


CVE ID: CVE-2026-11289 Severity: MEDIUM (CVSS 6.5) CWE: CWE-1300, CWE-203 KEV (actively exploited): NO Description: Side-channel information leakage in Paint in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)


CVE ID: CVE-2026-11288 Severity: MEDIUM (CVSS 6.5) CWE: CWE-693 KEV (actively exploited): NO Description: Insufficient policy enforcement in CSS in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)


CVE ID: CVE-2026-11287 Severity: MEDIUM (CVSS 6.5) CWE: CWE-20, CWE-602 KEV (actively exploited): NO Description: Insufficient policy enforcement in Navigation in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)


CVE ID: CVE-2026-11286 Severity: MEDIUM (CVSS 4.3) CWE: CWE-20, CWE-451 KEV (actively exploited): NO Description: Insufficient validation of untrusted input in Wallet in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)


CVE ID: CVE-2026-11285 Severity: MEDIUM (CVSS 4.3) CWE: CWE-451 KEV (actively exploited): NO Description: Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)


CVE ID: CVE-2026-11284 Severity: MEDIUM (CVSS 6.5) CWE: CWE-1300, CWE-203 KEV (actively exploited): NO Description: Side-channel information leakage in PerformanceAPIs in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)


CVE ID: CVE-2026-11283 Severity: MEDIUM (CVSS 6.5) CWE: CWE-20 KEV (actively exploited): NO Description: Insufficient validation of untrusted input in Shortcuts in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker to bypass navigation restrictions via a malicious file. (Chromium security severity: Low)


CVE ID: CVE-2026-11282 Severity: CRITICAL (CVSS 9.6) CWE: CWE-693 KEV (actively exploited): NO Description: Insufficient policy enforcement in Sandbox in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)


CVE ID: CVE-2026-11281 Severity: MEDIUM (CVSS 5.0) CWE: CWE-190, CWE-472 KEV (actively exploited): NO Description: Integer overflow in Chromoting in Google Chrome on Windows prior to 149.0.7827.53 allowed a local attacker to obtain potentially sensitive information from process memory via a crafted ETW event. (Chromium security severity: Low)


CVE ID: CVE-2026-11280 Severity: MEDIUM (CVSS 4.3) CWE: CWE-20 KEV (actively exploited): NO Description: Inappropriate implementation in Signin in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)


CVE ID: CVE-2026-11278 Severity: MEDIUM (CVSS 6.5) CWE: CWE-346 KEV (actively exploited): NO Description: Inappropriate implementation in CustomTabs in Google Chrome on Android prior to 149.0.7827.53 allowed a local attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)


CVE ID: CVE-2026-11277 Severity: MEDIUM (CVSS 4.3) CWE: CWE-284 KEV (actively exploited): NO Description: Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to bypass discretionary access control via a crafted HTML page. (Chromium security severity: Low)


CVE ID: CVE-2026-11275 Severity: MEDIUM (CVSS 6.5) CWE: CWE-284 KEV (actively exploited): NO Description: Inappropriate implementation in Page Info in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)


CVE ID: CVE-2026-11274 Severity: MEDIUM (CVSS 4.3) CWE: CWE-284 KEV (actively exploited): NO Description: Inappropriate implementation in DOM Distiller in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)


CVE ID: CVE-2026-11273 Severity: MEDIUM (CVSS 6.1) CWE: CWE-20, CWE-79 KEV (actively exploited): NO Description: Insufficient validation of untrusted input in Omnibox in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Low)


CVE ID: CVE-2026-11272 Severity: HIGH (CVSS 8.8) CWE: CWE-20 KEV (actively exploited): NO Description: Insufficient validation of untrusted input in Reading List in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform privilege escalation via a crafted HTML page. (Chromium security severity: Low)


CVE ID: CVE-2026-11271 Severity: MEDIUM (CVSS 6.5) CWE: CWE-200 KEV (actively exploited): NO Description: Inappropriate implementation in Passwords in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)


CVE ID: CVE-2026-11270 Severity: MEDIUM (CVSS 6.5) CWE: CWE-352 KEV (actively exploited): NO Description: Inappropriate implementation in UI in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)


CVE ID: CVE-2026-11268 Severity: MEDIUM (CVSS 6.5) CWE: CWE-457 KEV (actively exploited): NO Description: Uninitialized Use in ANGLE in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)


CVE ID: CVE-2026-11267 Severity: MEDIUM (CVSS 4.3) CWE: CWE-602 KEV (actively exploited): NO Description: Insufficient policy enforcement in Extensions in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to bypass content security policy via a crafted Chrome Extension. (Chromium security severity: Low)


CVE ID: CVE-2026-11266 Severity: MEDIUM (CVSS 4.3) CWE: CWE-693 KEV (actively exploited): NO Description: Inappropriate implementation in SafeBrowsing in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass Safe Browsing via a malicious file. (Chromium security severity: Low)


CVE ID: CVE-2026-11265 Severity: HIGH (CVSS 7.5) CWE: CWE-352 KEV (actively exploited): NO Description: Inappropriate implementation in Autofill in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)


CVE ID: CVE-2026-11264 Severity: MEDIUM (CVSS 4.3) CWE: CWE-693 KEV (actively exploited): NO Description: Policy bypass in Content Security Policy in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium security severity: Low)


CVE ID: CVE-2026-11263 Severity: MEDIUM (CVSS 6.5) CWE: CWE-693 KEV (actively exploited): NO Description: Insufficient policy enforcement in WebAuthentication in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)


CVE ID: CVE-2026-11261 Severity: MEDIUM (CVSS 4.3) CWE: CWE-20 KEV (actively exploited): NO Description: Inappropriate implementation in PDF in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)


CVE ID: CVE-2026-11260 Severity: MEDIUM (CVSS 4.3) CWE: CWE-693 KEV (actively exploited): NO Description: Inappropriate implementation in Permissions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium security severity: Low)


CVE ID: CVE-2026-11259 Severity: MEDIUM (CVSS 4.3) CWE: CWE-20 KEV (actively exploited): NO Description: Insufficient validation of untrusted input in Cast in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Low)


CVE ID: CVE-2026-11258 Severity: MEDIUM (CVSS 6.5) CWE: CWE-284 KEV (actively exploited): NO Description: Inappropriate implementation in File System Access in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to bypass discretionary access control via a crafted HTML page. (Chromium security severity: Low)


CVE ID: CVE-2026-11257 Severity: MEDIUM (CVSS 4.3) CWE: CWE-284 KEV (actively exploited): NO Description: Inappropriate implementation in Browser in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)


CVE ID: CVE-2026-11057 Severity: MEDIUM (CVSS 6.5) CWE: CWE-457 KEV (actively exploited): NO Description: Uninitialized Use in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)


CVE ID: CVE-2026-11051 Severity: MEDIUM (CVSS 6.5) CWE: CWE-125 KEV (actively exploited): NO Description: Out of bounds read in ANGLE in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)


CVE ID: CVE-2026-11048 Severity: MEDIUM (CVSS 6.5) CWE: CWE-346 KEV (actively exploited): NO Description: Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to bypass same origin policy via a crafted Chrome Extension. (Chromium security severity: Medium)


CVE ID: CVE-2026-11047 Severity: CRITICAL (CVSS 9.6) CWE: CWE-20 KEV (actively exploited): NO Description: Inappropriate implementation in Base in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)


CVE ID: CVE-2026-11045 Severity: MEDIUM (CVSS 6.5) CWE: CWE-20 KEV (actively exploited): NO Description: Insufficient validation of untrusted input in GPU in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)


CVE ID: CVE-2026-11044 Severity: MEDIUM (CVSS 6.5) CWE: CWE-190, CWE-472 KEV (actively exploited): NO Description: Integer overflow in ANGLE in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)


CVE ID: CVE-2026-11043 Severity: CRITICAL (CVSS 9.6) CWE: CWE-787 KEV (actively exploited): NO Description: Out of bounds write in ANGLE in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)


CVE ID: CVE-2026-11039 Severity: MEDIUM (CVSS 6.5) CWE: CWE-457 KEV (actively exploited): NO Description: Uninitialized Use in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)


CVE ID: CVE-2026-11035 Severity: HIGH (CVSS 7.3) CWE: CWE-20 KEV (actively exploited): NO Description: Inappropriate implementation in Custom Tabs in Google Chrome on Android prior to 149.0.7827.53 allowed a local attacker to perform privilege escalation via a crafted XML file. (Chromium security severity: Medium)


CVE ID: CVE-2026-11034 Severity: MEDIUM (CVSS 6.1) CWE: CWE-20 KEV (actively exploited): NO Description: Insufficient validation of untrusted input in Tab Group Sync in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via malicious network traffic. (Chromium security severity: Medium)


CVE ID: CVE-2026-11032 Severity: MEDIUM (CVSS 6.5) CWE: CWE-346 KEV (actively exploited): NO Description: Inappropriate implementation in Password Manager in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)


CVE ID: CVE-2026-11031 Severity: MEDIUM (CVSS 4.3) CWE: CWE-20 KEV (actively exploited): NO Description: Insufficient validation of untrusted input in Password Manager in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via malicious network traffic. (Chromium security severity: Medium)


CVE ID: CVE-2026-11030 Severity: HIGH (CVSS 8.8) CWE: CWE-416 KEV (actively exploited): NO Description: Use after free in Network in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially exploit heap corruption via malicious network traffic. (Chromium security severity: Medium)


CVE ID: CVE-2026-11027 Severity: MEDIUM (CVSS 6.5) CWE: CWE-20 KEV (actively exploited): NO Description: Insufficient validation of untrusted input in Glic in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)


CVE ID: CVE-2026-11026 Severity: MEDIUM (CVSS 6.5) CWE: CWE-284 KEV (actively exploited): NO Description: Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extension. (Chromium security severity: Medium)


CVE ID: CVE-2026-10951 Severity: HIGH (CVSS 8.8) CWE: CWE-416 KEV (actively exploited): NO Description: Use after free in Autofill in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)


CVE ID: CVE-2026-10950 Severity: MEDIUM (CVSS 6.5) CWE: CWE-693 KEV (actively exploited): NO Description: Insufficient policy enforcement in Autofill in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)


CVE ID: CVE-2026-10944 Severity: MEDIUM (CVSS 6.5) CWE: CWE-693 KEV (actively exploited): NO Description: Insufficient policy enforcement in Autofill in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)


CVE ID: CVE-2026-10873 Severity: HIGH (CVSS 7.3) CWE: CWE-77, CWE-78 KEV (actively exploited): NO Description: A vulnerability was determined in Shibby Tomato 1.28.0000. Impacted is the function rstats_path of the file /bin/rstats of the component Web UI. Executing a manipulation can lead to os command injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This project is superseded by FreshTomato.


CVE ID: CVE-2026-10901 Severity: HIGH (CVSS 7.5) CWE: CWE-416 Affected: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Use after free in Passwords in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)


CVE ID: CVE-2026-10902 Severity: HIGH (CVSS 8.8) CWE: CWE-416 Affected: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*, cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Use after free in Ozone in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)


CVE ID: CVE-2026-10903 Severity: HIGH (CVSS 8.8) CWE: CWE-416 Affected: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*, cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Use after free in WebRTC in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)


CVE ID: CVE-2026-10904 Severity: HIGH (CVSS 8.8) CWE: CWE-119, CWE-20, CWE-94 Affected: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*, cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Inappropriate implementation in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)


CVE ID: CVE-2026-10887 Severity: HIGH (CVSS 8.1) CWE: CWE-416 Affected: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Use after free in Chromoting in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code via malicious network traffic. (Chromium security severity: Critical)


CVE ID: CVE-2026-10888 Severity: HIGH (CVSS 8.8) CWE: CWE-416 Affected: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*, cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Use after free in Cast Streaming in Google Chrome prior to 149.0.7827.53 allowed an attacker on the local network segment to execute arbitrary code via malicious network traffic. (Chromium security severity: Critical)


CVE ID: CVE-2026-10889 Severity: HIGH (CVSS 8.3) CWE: CWE-125 Affected: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*, cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Out of bounds read in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)


CVE ID: CVE-2026-10890 Severity: HIGH (CVSS 8.8) CWE: CWE-416 Affected: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*, cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Use after free in Cast in Google Chrome prior to 149.0.7827.53 allowed an attacker on the local network segment to potentially exploit heap corruption via malicious network traffic. (Chromium security severity: Critical)


CVE ID: CVE-2026-10892 Severity: CRITICAL (CVSS 9.6) CWE: CWE-787 Affected: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, cpe:2.3:o:google:android:-:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Out of bounds write in GPU in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)


CVE ID: CVE-2026-10893 Severity: HIGH (CVSS 8.8) CWE: CWE-416 Affected: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*, cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Use after free in Chromoting in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code via malicious network traffic. (Chromium security severity: Critical)


CVE ID: CVE-2018-12437 Severity: MEDIUM (CVSS 4.9) CWE: CWE-200 Affected: cpe:2.3:a:libtom:libtomcrypt:*:*:*:*:*:*:*:*, cpe:2.3:o:trustedfirmware:op-tee:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: LibTomCrypt through 1.18.1 allows a memory-cache side-channel attack on ECDSA signatures, aka the Return Of the Hidden Number Problem or ROHNP. To discover an ECDSA key, the attacker needs access to either the local machine or a different virtual machine on the same physical host.


CVE ID: CVE-2019-1010293 Severity: CRITICAL (CVSS 9.8) CWE: CWE-787 Affected: cpe:2.3:o:trustedfirmware:op-tee:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Linaro/OP-TEE OP-TEE 3.3.0 and earlier is affected by: Boundary crossing. The impact is: Memory corruption of the TEE itself. The component is: optee_os. The fixed version is: 3.4.0 and later.


CVE ID: CVE-2019-1010294 Severity: HIGH (CVSS 7.5) CWE: CWE-189 Affected: cpe:2.3:o:trustedfirmware:op-tee:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Linaro/OP-TEE OP-TEE 3.3.0 and earlier is affected by: Rounding error. The impact is: Potentially leaking code and/or data from previous Trusted Application. The component is: optee_os. The fixed version is: 3.4.0 and later.


CVE ID: CVE-2019-1010295 Severity: CRITICAL (CVSS 9.8) CWE: CWE-125, CWE-20, CWE-787 Affected: cpe:2.3:o:trustedfirmware:op-tee:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Linaro/OP-TEE OP-TEE 3.3.0 and earlier is affected by: Buffer Overflow. The impact is: Memory corruption and disclosure of memory content. The component is: optee_os. The fixed version is: 3.4.0 and later.


CVE ID: CVE-2019-1010296 Severity: CRITICAL (CVSS 9.8) CWE: CWE-190, CWE-787 Affected: cpe:2.3:o:trustedfirmware:op-tee:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Linaro/OP-TEE OP-TEE 3.3.0 and earlier is affected by: Buffer Overflow. The impact is: Code execution in context of TEE core (kernel). The component is: optee_os. The fixed version is: 3.4.0 and later.


CVE ID: CVE-2019-1010297 Severity: CRITICAL (CVSS 9.8) CWE: CWE-190, CWE-787 Affected: cpe:2.3:o:trustedfirmware:op-tee:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Linaro/OP-TEE OP-TEE 3.3.0 and earlier is affected by: Buffer Overflow. The impact is: Execution of code in TEE core (kernel) context. The component is: optee_os. The fixed version is: 3.4.0 and later.


CVE ID: CVE-2019-1010298 Severity: CRITICAL (CVSS 9.8) CWE: CWE-190, CWE-787 Affected: cpe:2.3:o:trustedfirmware:op-tee:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Linaro/OP-TEE OP-TEE 3.3.0 and earlier is affected by: Buffer Overflow. The impact is: Code execution in the context of TEE core (kernel). The component is: optee_os. The fixed version is: 3.4.0 and later.


CVE ID: CVE-2019-1010292 Severity: CRITICAL (CVSS 9.8) CWE: CWE-787 Affected: cpe:2.3:o:trustedfirmware:op-tee:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Linaro/OP-TEE OP-TEE Prior to version v3.4.0 is affected by: Boundary checks. The impact is: This could lead to corruption of any memory which the TA can access. The component is: optee_os. The fixed version is: v3.4.0.


CVE ID: CVE-2020-13799 Severity: MEDIUM (CVSS 6.8) CWE: CWE-294 Affected: cpe:2.3:h:westerndigital:inand_cl_em132:-:*:*:*:*:*:*:*, cpe:2.3:h:westerndigital:inand_ix_em132:-:*:*:*:*:*:*:*, cpe:2.3:h:westerndigital:inand_ix_em132_xi:-:*:*:*:*:*:*:*, cpe:2.3:o:trustedfirmware:op-tee:*:*:*:*:*:*:*:*, cpe:2.3:o:westerndigital:inand_cl_em132_firmware:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Western Digital has identified a security vulnerability in the Replay Protected Memory Block (RPMB) protocol as specified in multiple standards for storage device interfaces, including all versions of eMMC, UFS, and NVMe. The RPMB protocol is specified by industry standards bodies and is implemented by storage devices from multiple vendors to assist host systems in securing trusted firmware. Several scenarios have been identified in which the RPMB state may be affected by an attacker without the knowledge of the trusted component that uses the RPMB feature.


CVE ID: CVE-2019-25052 Severity: CRITICAL (CVSS 9.1) CWE: CWE-327 Affected: cpe:2.3:o:trustedfirmware:op-tee:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: In Linaro OP-TEE before 3.7.0, by using inconsistent or malformed data, it is possible to call update and final cryptographic functions directly, causing a crash that could leak sensitive information.


CVE ID: CVE-2021-36133 Severity: HIGH (CVSS 7.1) CWE: CWE-732 Affected: cpe:2.3:h:nxp:i.mx6sx:-:*:*:*:*:*:*:*, cpe:2.3:h:nxp:i.mx_6:-:*:*:*:*:*:*:*, cpe:2.3:h:nxp:i.mx_6solox:-:*:*:*:*:*:*:*, cpe:2.3:h:nxp:i.mx_6ull:-:*:*:*:*:*:*:*, cpe:2.3:h:nxp:i.mx_6ulz:-:*:*:*:*:*:*:* KEV (actively exploited): NO Description: The OPTEE-OS CSU driver for NXP i.MX SoC devices lacks security access configuration for several models, resulting in TrustZone bypass because the NonSecure World can perform arbitrary memory read/write operations on Secure World memory. This involves a DMA capable peripheral.


CVE ID: CVE-2021-44149 Severity: HIGH (CVSS 7.8) Affected: cpe:2.3:h:nxp:i.mx_6ultralite:-:*:*:*:*:*:*:*, cpe:2.3:o:trustedfirmware:op-tee:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: An issue was discovered in Trusted Firmware OP-TEE Trusted OS through 3.15.0. The OPTEE-OS CSU driver for NXP i.MX6UL SoC devices lacks security access configuration for wakeup-related registers, resulting in TrustZone bypass because the NonSecure World can perform arbitrary memory read/write operations on Secure World memory. This involves a v cycle.


CVE ID: CVE-2022-47549 Severity: MEDIUM (CVSS 6.4) CWE: CWE-347 Affected: cpe:2.3:o:trustedfirmware:op-tee:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: An unprotected memory-access operation in optee_os in TrustedFirmware Open Portable Trusted Execution Environment (OP-TEE) before 3.20 allows a physically proximate adversary to bypass signature verification and install malicious trusted applications via electromagnetic fault injections.


CVE ID: CVE-2023-41325 Severity: MEDIUM (CVSS 6.7) CWE: CWE-415 Affected: cpe:2.3:o:trustedfirmware:op-tee:*:*:*:*:*:*:*:*, cpe:2.3:o:trustedfirmware:op-tee:3.22.0:rc1:*:*:*:*:*:* KEV (actively exploited): NO Description: OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. Starting in version 3.20 and prior to version 3.22, `shdr_verify_signature` can make a double free. `shdr_verify_signature` used to verify a TA binary before it is loaded. To verify a signature of it, allocate a memory for RSA key. RSA key allocate function (`sw_crypto_acipher_alloc_rsa_public_key`) will try to allocate a memory (which is optee’s heap memory). RSA key is consist of exponent and modulus (represent as variable `e`, `n`) and it allocation is not atomic way, so it may succeed in `e` but fail in `n`. In this case sw_crypto_acipher_alloc_rsa_public_key` will free on `e` and return as it is failed but variable ‘e’ is remained as already freed memory address . `shdr_verify_signature` will free again that memory (which is `e`) even it is freed when it failed allocate RSA key. A patch is available in version 3.22. No known workarounds are available.


CVE ID: CVE-2026-45702 Severity: MEDIUM (CVSS 5.5) CWE: CWE-843 Affected: cpe:2.3:o:trustedfirmware:op-tee:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. Starting in version 4.3.0 and prior to version 4.11.0, a type confusion vulnerability exists in OP-TEE OS when processing an FFA_MEM_SHARE request from the normal world. This only applies when OP-TEE is configured as an SPMC for S-EL0 SPs, that is, with `CFG_CORE_SEL1_SPMC=y` and `CFG_SECURE_PARTITION=y`. Version 4.11.0 fixes the issue.


CVE ID: CVE-2026-10894 Severity: HIGH (CVSS 8.3) CWE: CWE-416 Affected: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Use after free in Printing in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)


CVE ID: CVE-2026-10910 Severity: HIGH (CVSS 8.8) CWE: CWE-843 Affected: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*, cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Type Confusion in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)


CVE ID: CVE-2026-10911 Severity: HIGH (CVSS 8.3) CWE: CWE-20 Affected: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*, cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Insufficient validation of untrusted input in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)


CVE ID: CVE-2026-10913 Severity: HIGH (CVSS 8.8) CWE: CWE-416 Affected: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Use after free in ANGLE in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)


CVE ID: CVE-2026-10914 Severity: HIGH (CVSS 8.8) CWE: CWE-416 Affected: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Use after free in ANGLE in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)


CVE ID: CVE-2026-10915 Severity: HIGH (CVSS 8.3) CWE: CWE-416 Affected: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, cpe:2.3:o:apple:iphone_os:-:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Use after free in Core in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)


CVE ID: CVE-2026-10922 Severity: HIGH (CVSS 8.8) CWE: CWE-20 Affected: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*, cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Insufficient validation of untrusted input in DevTools in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to bypass same origin policy via malicious network traffic. (Chromium security severity: High)


CVE ID: CVE-2026-10928 Severity: HIGH (CVSS 8.8) CWE: CWE-94 Affected: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*, cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Script injection in Headless in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)


CVE ID: CVE-2026-10929 Severity: HIGH (CVSS 8.3) CWE: CWE-122 Affected: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, cpe:2.3:o:google:android:-:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Heap buffer overflow in ANGLE in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)


CVE ID: CVE-2021-27562 Severity: MEDIUM (CVSS 5.5) CWE: CWE-787 Affected: cpe:2.3:o:trustedfirmware:trusted_firmware-m:*:*:*:*:*:*:*:* KEV (actively exploited): YES Description: In Arm Trusted Firmware M through 1.2, the NS world may trigger a system halt, an overwrite of secure data, or the printing out of secure data when calling secure functions under the NSPE handler mode. Required action: Apply updates per vendor instructions.


CVE ID: CVE-2021-43619 Severity: HIGH (CVSS 7.8) CWE: CWE-120 Affected: cpe:2.3:o:trustedfirmware:trusted_firmware-m:1.4.0:*:*:*:*:*:*:*, cpe:2.3:o:trustedfirmware:trusted_firmware-m:1.4.1:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Trusted Firmware M 1.4.x through 1.4.1 has a buffer overflow issue in the Firmware Update partition. In the IPC model, a psa_fwu_write caller from SPE or NSPE can overwrite stack memory locations.


CVE ID: CVE-2023-40271 Severity: HIGH (CVSS 7.5) CWE: CWE-697 Affected: cpe:2.3:o:trustedfirmware:trusted_firmware-m:1.6.0:*:*:*:*:*:*:*, cpe:2.3:o:trustedfirmware:trusted_firmware-m:1.6.1:*:*:*:*:*:*:*, cpe:2.3:o:trustedfirmware:trusted_firmware-m:1.7.0:*:*:*:*:*:*:*, cpe:2.3:o:trustedfirmware:trusted_firmware-m:1.8.0:*:*:*:*:*:*:* KEV (actively exploited): NO Description: In Trusted Firmware-M through TF-Mv1.8.0, for platforms that integrate the CryptoCell accelerator, when the CryptoCell PSA Driver software Interface is selected, and the Authenticated Encryption with Associated Data Chacha20-Poly1305 algorithm is used, with the single-part verification function (defined during the build-time configuration phase) implemented with a dedicated function (i.e., not relying on usage of multipart functions), the buffer comparison during the verification of the authentication tag does not happen on the full 16 bytes but just on the first 4 bytes, thus leading to the possibility that unauthenticated payloads might be identified as authentic. This affects TF-Mv1.6.0, TF-Mv1.6.1, TF-Mv1.7.0, and TF-Mv1.8.


CVE ID: CVE-2023-51712 Severity: MEDIUM (CVSS 4.7) Affected: cpe:2.3:o:trustedfirmware:trusted_firmware-m:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: An issue was discovered in Trusted Firmware-M through 2.0.0. The lack of argument verification in the logging subsystem allows attackers to read sensitive data via the login function.


CVE ID: CVE-2017-9607 Severity: HIGH (CVSS 7.0) CWE: CWE-190 Affected: cpe:2.3:o:trustedfirmware:trusted_firmware-a:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: The BL1 FWU SMC handling code in ARM Trusted Firmware before 1.4 might allow attackers to write arbitrary data to secure memory, bypass the bl1_plat_mem_check protection mechanism, cause a denial of service, or possibly have unspecified other impact via a crafted AArch32 image, which triggers an integer overflow.


CVE ID: CVE-2018-19440 Severity: MEDIUM (CVSS 5.3) CWE: CWE-200 Affected: cpe:2.3:o:trustedfirmware:trusted_firmware-a:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: ARM Trusted Firmware-A allows information disclosure.


CVE ID: CVE-2022-47630 Severity: HIGH (CVSS 7.4) CWE: CWE-125 Affected: cpe:2.3:o:trustedfirmware:trusted_firmware-a:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Trusted Firmware-A through 2.8 has an out-of-bounds read in the X.509 parser for parsing boot certificates. This affects downstream use of get_ext and auth_nvctr. Attackers might be able to trigger dangerous read side effects or obtain sensitive information about microarchitectural state.


CVE ID: CVE-2023-31339 Severity: MEDIUM (CVSS 5.8) CWE: CWE-125, CWE-20 Affected: cpe:2.3:h:amd:zu11eg:-:*:*:*:*:*:*:*, cpe:2.3:h:amd:zu15eg:-:*:*:*:*:*:*:*, cpe:2.3:h:amd:zu17eg:-:*:*:*:*:*:*:*, cpe:2.3:h:amd:zu19eg:-:*:*:*:*:*:*:*, cpe:2.3:h:amd:zu1cg:-:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Improper input validation in ARM® Trusted Firmware used in AMD’s Zynq™ UltraScale+™) MPSoC/RFSoC may allow a privileged attacker to perform out of bound reads, potentially resulting in data leakage and denial of service.


CVE ID: CVE-2017-15031 Severity: HIGH (CVSS 7.5) CWE: CWE-200 Affected: cpe:2.3:o:trustedfirmware:trusted_firmware-a:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: In all versions of ARM Trusted Firmware up to and including v1.4, not initializing or saving/restoring the PMCR_EL0 register can leak secure world timing information.


CVE ID: CVE-2026-10905 Severity: HIGH (CVSS 8.3) CWE: CWE-416 Affected: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*, cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Use after free in Network in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)


CVE ID: CVE-2026-10906 Severity: HIGH (CVSS 7.5) CWE: CWE-416 Affected: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*, cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Use after free in WebAuthentication in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)


CVE ID: CVE-2026-10907 Severity: HIGH (CVSS 8.8) CWE: CWE-787 Affected: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*, cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Out of bounds write in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)


CVE ID: CVE-2026-10908 Severity: HIGH (CVSS 8.3) CWE: CWE-416 Affected: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Use after free in FullScreen in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)


CVE ID: CVE-2026-10909 Severity: HIGH (CVSS 8.3) CWE: CWE-416 Affected: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*, cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Use after free in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)


CVE ID: CVE-2026-4276 Severity: HIGH (CVSS 7.5) CWE: CWE-94 Affected: cpe:2.3:a:librechat:librechat:0.7.0:*:*:*:*:*:*:* KEV (actively exploited): NO Description: LibreChat RAG API, version 0.7.0, contains a log-injection vulnerability that allows attackers to forge log entries.


CVE ID: CVE-2025-2274 Severity: MEDIUM (CVSS 4.8) CWE: CWE-79 Affected: cpe:2.3:a:forcepoint:web_security:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Improper Neutralization of Input During Web Page Generation in Forcepoint Web Security (On-Prem) on Windows allows Stored XSS.This issue affects Web Security through 8.5.6.


CVE ID: CVE-2025-15515 Severity: MEDIUM (CVSS 6.9) CWE: CWE-306 Affected: cpe:2.3:a:vivo:easyshare:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: The authentication mechanism for a specific feature in the EasyShare module contains a vulnerability. If specific conditions are met on a local network, it can cause data leakage


CVE ID: CVE-2025-57849 Severity: MEDIUM (CVSS 6.4) CWE: CWE-276 Affected: cpe:2.3:a:redhat:fuse:7.0.0:*:*:*:*:*:*:* KEV (actively exploited): NO Description: A container privilege escalation flaw was found in certain Fuse images. This issue stems from the /etc/passwd file being created with group-writable permissions during build time. In certain conditions, an attacker who can execute commands within an affected container, even as a non-root user, can leverage their membership in the root group to modify the /etc/passwd file. This could allow the attacker to add a new user with any arbitrary UID, including UID 0, leading to full root privileges within the container.


CVE ID: CVE-2025-8766 Severity: MEDIUM (CVSS 6.4) CWE: CWE-276 Affected: cpe:2.3:a:redhat:openshift_data_foundation:4.0:*:*:*:*:*:*:* KEV (actively exploited): NO Description: A container privilege escalation flaw was found in certain Multi-Cloud Object Gateway Core images. This issue stems from the /etc/passwd file being created with group-writable permissions during build time. In certain conditions, an attacker who can execute commands within an affected container, even as a non-root user, can leverage their membership in the root group to modify the /etc/passwd file. This could allow the attacker to add a new user with any arbitrary UID, including UID 0, leading to full root privileges within the container


CVE ID: CVE-2026-10854 Severity: MEDIUM (CVSS 5.3) CWE: CWE-200 Affected: cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: A visibility control issue in the event template creation workflow allowed non-site-admin users to access private galaxies belonging to other organisations. The event template builder loaded all enabled galaxies without applying organisation or distribution-based access restrictions, potentially exposing private galaxy metadata such as galaxy type and description to users who should not have visibility. The issue has been fixed by restricting galaxy queries for non-site-admin users to galaxies owned by the user’s organisation or galaxies with a non-private distribution setting. Site administrators retain visibility of all enabled galaxies.


CVE ID: CVE-2026-2673 Severity: MEDIUM (CVSS 6.5) CWE: CWE-757 Affected: cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*, cpe:2.3:h:siemens:simatic_cn_4100:-:*:*:*:*:*:*:*, cpe:2.3:o:siemens:simatic_cn_4100_firmware:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Issue summary: An OpenSSL TLS 1.3 server may fail to negotiate the expected preferred key exchange group when its key exchange group configuration includes the default by using the 'DEFAULT' keyword. Impact summary: A less preferred key exchange may be used even when a more preferred group is supported by both client and server, if the group was not included among the client's initial predicated keyshares. This will sometimes be the case with the new hybrid post-quantum groups, if the client chooses to defer their use until specifically requested by the server. If an OpenSSL TLS 1.3 server's configuration uses the 'DEFAULT' keyword to interpolate the built-in default group list into its own configuration, perhaps adding or removing specific elements, then an implementation defect causes the 'DEFAULT' list to lose its 'tuple' structure, and all server-supported groups were treated as a single sufficiently secure 'tuple', with the server not sending a Hello Retry Request (HRR) even when a group in a more preferred tuple was mutually supported. As a result, the client and server might fail to negotiate a mutually supported post-quantum key agreement group, such as 'X25519MLKEM768', if the client's configuration results in only 'classical' groups (such as 'X25519' being the only ones in the client's initial keyshare prediction). OpenSSL 3.5 and later support a new syntax for selecting the most preferred TLS 1.3 key agreement group on TLS servers. The old syntax had a single 'flat' list of groups, and treated all the supported groups as sufficiently secure. If any of the keyshares predicted by the client were supported by the server the most preferred among these was selected, even if other groups supported by the client, but not included in the list of predicted keyshares would have been more preferred, if included. The new syntax partitions the groups into distinct 'tuples' of roughly equivalent security. Within each tuple the most preferred group included among the client's predicted keyshares is chosen, but if the client supports a group from a more preferred tuple, but did not predict any corresponding keyshares, the server will ask the client to retry the ClientHello (by issuing a Hello Retry Request or HRR) with the most preferred mutually supported group. The above works as expected when the server's configuration uses the built-in default group list, or explicitly defines its own list by directly defining the various desired groups and group 'tuples'. No OpenSSL FIPS modules are affected by this issue, the code in question lies outside the FIPS boundary. OpenSSL 3.6 and 3.5 are vulnerable to this issue. OpenSSL 3.6 users should upgrade to OpenSSL 3.6.2 once it is released. OpenSSL 3.5 users should upgrade to OpenSSL 3.5.6 once it is released. OpenSSL 3.4, 3.3, 3.0, 1.0.2 and 1.1.1 are not affected by this issue.


CVE ID: CVE-2026-10895 Severity: HIGH (CVSS 8.8) CWE: CWE-416 Affected: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*, cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Use after free in Ozone in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)


CVE ID: CVE-2026-0689 Severity: MEDIUM (CVSS 6.0) CWE: CWE-522 Affected: cpe:2.3:a:extremenetworks:extremecloud_iq_site_engine:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: In ExtremeCloud IQ – Site Engine (XIQ‑SE) before 26.2.10, a vulnerability in the NAC administration interface allows an authenticated NAC administrator to retrieve masked sensitive parameters from HTTP responses. Although credentials appear redacted in the user interface, the application returns the underlying credential values in the HTTP response, enabling an authorized administrator to recover stored secrets that may exceed their intended access. We would like to thank the Lockheed Martin Red Team for responsibly reporting this issue and working with us through coordinated disclosure.


CVE ID: CVE-2026-21708 Severity: CRITICAL (CVSS 9.9) CWE: CWE-89 Affected: cpe:2.3:a:veeam:veeam_backup_\&_replication:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: A vulnerability allowing a Backup Viewer to perform remote code execution (RCE) as the postgres user.


CVE ID: CVE-2026-10896 Severity: HIGH (CVSS 8.8) CWE: CWE-416 Affected: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, cpe:2.3:o:apple:iphone_os:-:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Use after free in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)


CVE ID: CVE-2025-13462 Severity: LOW (CVSS 2.0) CWE: CWE-20, CWE-434, CWE-74 Affected: cpe:2.3:a:python:python:*:*:*:*:*:*:*:*, cpe:2.3:a:python:python:3.15.0:alpha1:*:*:*:*:*:*, cpe:2.3:a:python:python:3.15.0:alpha2:*:*:*:*:*:*, cpe:2.3:a:python:python:3.15.0:alpha3:*:*:*:*:*:*, cpe:2.3:a:python:python:3.15.0:alpha4:*:*:*:*:*:* KEV (actively exploited): NO Description: The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPE_LONGNAME or GNUTYPE_LONGLINK. This could result in a crafted tar archive being misinterpreted by the tarfile module compared to other implementations.


CVE ID: CVE-2025-13913 Severity: MEDIUM (CVSS 5.4) CWE: CWE-502 Affected: cpe:2.3:a:inductiveautomation:ignition:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: A privileged Ignition user, intentionally or otherwise, imports an external file with a specially crafted payload, which executes embedded malicious code.


CVE ID: CVE-2026-34875 Severity: CRITICAL (CVSS 9.8) CWE: CWE-120 Affected: cpe:2.3:a:trustedfirmware:mbed_tls:*:*:*:*:*:*:*:*, cpe:2.3:a:trustedfirmware:tf-psa-crypto:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: An issue was discovered in Mbed TLS through 3.6.5 and TF-PSA-Crypto 1.0.0. A buffer overflow can occur in public key export for FFDH keys.


CVE ID: CVE-2026-25835 Severity: HIGH (CVSS 7.7) CWE: CWE-335 Affected: cpe:2.3:a:arm:mbed_tls:*:*:*:*:*:*:*:*, cpe:2.3:a:trustedfirmware:mbed_tls:4.0.0:*:*:*:*:*:*:*, cpe:2.3:a:trustedfirmware:tf-psa-crypto:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Mbed TLS before 3.6.6 and TF-PSA-Crypto before 1.1.0 misuse seeds in a Pseudo-Random Number Generator (PRNG).


CVE ID: CVE-2026-34871 Severity: MEDIUM (CVSS 6.7) CWE: CWE-338 Affected: cpe:2.3:a:arm:mbed_tls:*:*:*:*:*:*:*:*, cpe:2.3:a:trustedfirmware:tf-psa-crypto:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: An issue was discovered in Mbed TLS before 3.6.6 and 4.x before 4.1.0 and TF-PSA-Crypto before 1.1.0. There is a Predictable Seed in a Pseudo-Random Number Generator (PRNG).


CVE ID: CVE-2026-3611 Severity: CRITICAL (CVSS 10.0) CWE: CWE-306 Affected: cpe:2.3:h:honeywell:iq412:-:*:*:*:*:*:*:*, cpe:2.3:h:honeywell:iq41x:-:*:*:*:*:*:*:*, cpe:2.3:h:honeywell:iq422:-:*:*:*:*:*:*:*, cpe:2.3:h:honeywell:iq4e:-:*:*:*:*:*:*:*, cpe:2.3:h:honeywell:iq4nc:-:*:*:*:*:*:*:* KEV (actively exploited): NO Description: The Honeywell IQ4x building management controller, exposes its full web-based HMI without authentication in its factory-default configuration. With no user module configured, security is disabled by design and the system operates under a System Guest (level 100) context, granting read/write privileges to any party able to reach the HTTP interface. Authentication controls are only enforced after a web user is created via U.htm, which dynamically enables the user module. Because this function is accessible prior to authentication, a remote user can create a new account with administrative read/write permissions enabling the user module and imposing authentication under attacker-controlled credentials. This action can effectively lock legitimate operators out of local and web-based configuration and administration.


CVE ID: CVE-2015-5291 Severity: UNKNOWN (CVSS 6.8) CWE: CWE-119 Affected: cpe:2.3:a:polarssl:polarssl:*:*:*:*:*:*:*:*, cpe:2.3:a:trustedfirmware:mbed_tls:*:*:*:*:*:*:*:*, cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*, cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*, cpe:2.3:o:fedoraproject:fedora:21:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Heap-based buffer overflow in PolarSSL 1.x before 1.2.17 and ARM mbed TLS (formerly PolarSSL) 1.3.x before 1.3.14 and 2.x before 2.1.2 allows remote SSL servers to cause a denial of service (client crash) and possibly execute arbitrary code via a long hostname to the server name indication (SNI) extension, which is not properly handled when creating a ClientHello message. NOTE: this identifier has been SPLIT per ADT3 due to different affected version ranges. See CVE-2015-8036 for the session ticket issue that was introduced in 1.3.0.


CVE ID: CVE-2015-8036 Severity: UNKNOWN (CVSS 6.8) CWE: CWE-119 Affected: cpe:2.3:a:polarssl:polarssl:*:*:*:*:*:*:*:*, cpe:2.3:a:trustedfirmware:mbed_tls:*:*:*:*:*:*:*:*, cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*, cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*, cpe:2.3:o:fedoraproject:fedora:21:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Heap-based buffer overflow in ARM mbed TLS (formerly PolarSSL) 1.3.x before 1.3.14 and 2.x before 2.1.2 allows remote SSL servers to cause a denial of service (client crash) and possibly execute arbitrary code via a long session ticket name to the session ticket extension, which is not properly handled when creating a ClientHello message to resume a session. NOTE: this identifier was SPLIT from CVE-2015-5291 per ADT3 due to different affected version ranges.


CVE ID: CVE-2017-2784 Severity: HIGH (CVSS 8.1) CWE: CWE-295 Affected: cpe:2.3:a:trustedfirmware:mbed_tls:*:*:*:*:*:*:*:*, cpe:2.3:a:trustedfirmware:mbed_tls:2.0.0:*:*:*:*:*:*:*, cpe:2.3:a:trustedfirmware:mbed_tls:2.1.0:*:*:*:*:*:*:*, cpe:2.3:a:trustedfirmware:mbed_tls:2.1.1:*:*:*:*:*:*:*, cpe:2.3:a:trustedfirmware:mbed_tls:2.1.2:*:*:*:*:*:*:* KEV (actively exploited): NO Description: An exploitable free of a stack pointer vulnerability exists in the x509 certificate parsing code of ARM mbed TLS before 1.3.19, 2.x before 2.1.7, and 2.4.x before 2.4.2. A specially crafted x509 certificate, when parsed by mbed TLS library, can cause an invalid free of a stack pointer leading to a potential remote code execution. In order to exploit this vulnerability, an attacker can act as either a client or a server on a network to deliver malicious x509 certificates to vulnerable applications.


CVE ID: CVE-2017-14032 Severity: HIGH (CVSS 8.1) CWE: CWE-287 Affected: cpe:2.3:a:arm:mbed_tls:1.3.19:*:*:*:*:*:*:*, cpe:2.3:a:arm:mbed_tls:1.3.21:*:*:*:*:*:*:*, cpe:2.3:a:arm:mbed_tls:2.1.7:*:*:*:*:*:*:*, cpe:2.3:a:arm:mbed_tls:2.1.9:*:*:*:*:*:*:*, cpe:2.3:a:arm:mbed_tls:2.4.2:*:*:*:*:*:*:* KEV (actively exploited): NO Description: ARM mbed TLS before 1.3.21 and 2.x before 2.1.9, if optional authentication is configured, allows remote attackers to bypass peer authentication via an X.509 certificate chain with many intermediates. NOTE: although mbed TLS was formerly known as PolarSSL, the releases shipped with the PolarSSL name are not affected.


CVE ID: CVE-2018-9988 Severity: HIGH (CVSS 7.5) CWE: CWE-125 Affected: cpe:2.3:a:arm:mbed_tls:*:*:*:*:*:*:*:*, cpe:2.3:a:trustedfirmware:mbed_tls:2.8.0:rc1:*:*:*:*:*:*, cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*, cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* KEV (actively exploited): NO Description: ARM mbed TLS before 2.1.11, before 2.7.2, and before 2.8.0 has a buffer over-read in ssl_parse_server_key_exchange() that could cause a crash on invalid input.


CVE ID: CVE-2018-9989 Severity: HIGH (CVSS 7.5) CWE: CWE-125 Affected: cpe:2.3:a:arm:mbed_tls:*:*:*:*:*:*:*:*, cpe:2.3:a:trustedfirmware:mbed_tls:2.8.0:rc1:*:*:*:*:*:*, cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*, cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* KEV (actively exploited): NO Description: ARM mbed TLS before 2.1.11, before 2.7.2, and before 2.8.0 has a buffer over-read in ssl_parse_server_psk_hint() that could cause a crash on invalid input.


CVE ID: CVE-2018-19608 Severity: MEDIUM (CVSS 4.7) CWE: CWE-269 Affected: cpe:2.3:a:arm:mbed_tls:*:*:*:*:*:*:*:*, cpe:2.3:a:trustedfirmware:mbed_tls:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Arm Mbed TLS before 2.14.1, before 2.7.8, and before 2.1.17 allows a local unprivileged attacker to recover the plaintext of RSA decryption, which is used in RSA-without-(EC)DH(E) cipher suites.


CVE ID: CVE-2019-16910 Severity: MEDIUM (CVSS 5.3) Affected: cpe:2.3:a:arm:mbed_crypto:*:*:*:*:*:*:*:*, cpe:2.3:a:arm:mbed_tls:*:*:*:*:*:*:*:*, cpe:2.3:a:trustedfirmware:mbed_tls:*:*:*:*:*:*:*:*, cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*, cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Arm Mbed TLS before 2.19.0 and Arm Mbed Crypto before 2.0.0, when deterministic ECDSA is enabled, use an RNG with insufficient entropy for blinding, which might allow an attacker to recover a private key via side-channel attacks if a victim signs the same message many times. (For Mbed TLS, the fix is also available in versions 2.7.12 and 2.16.3.)


CVE ID: CVE-2020-10932 Severity: MEDIUM (CVSS 4.7) CWE: CWE-203, CWE-327 Affected: cpe:2.3:a:arm:mbed_tls:*:*:*:*:*:*:*:*, cpe:2.3:a:trustedfirmware:mbed_tls:*:*:*:*:*:*:*:*, cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*, cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*, cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* KEV (actively exploited): NO Description: An issue was discovered in Arm Mbed TLS before 2.16.6 and 2.7.x before 2.7.15. An attacker that can get precise enough side-channel measurements can recover the long-term ECDSA private key by (1) reconstructing the projective coordinate of the result of scalar multiplication by exploiting side channels in the conversion to affine coordinates; (2) using an attack described by Naccache, Smart, and Stern in 2003 to recover a few bits of the ephemeral scalar from those projective coordinates via several measurements; and (3) using a lattice attack to get from there to the long-term ECDSA private key used for the signatures. Typically an attacker would have sufficient access when attacking an SGX enclave and controlling the untrusted OS.


CVE ID: CVE-2021-44732 Severity: CRITICAL (CVSS 9.8) CWE: CWE-415 Affected: cpe:2.3:a:arm:mbed_tls:*:*:*:*:*:*:*:*, cpe:2.3:a:trustedfirmware:mbed_tls:3.0.0:-:*:*:*:*:*:*, cpe:2.3:a:trustedfirmware:mbed_tls:3.0.0:preview1:*:*:*:*:*:*, cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Mbed TLS before 3.0.1 has a double free in certain out-of-memory conditions, as demonstrated by an mbedtls_ssl_set_session() failure.


CVE ID: CVE-2021-45450 Severity: HIGH (CVSS 7.5) CWE: CWE-327 Affected: cpe:2.3:a:trustedfirmware:mbed_tls:*:*:*:*:*:*:*:*, cpe:2.3:a:trustedfirmware:mbed_tls:3.0.0:*:*:*:*:*:*:*, cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*, cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* KEV (actively exploited): NO Description: In Mbed TLS before 2.28.0 and 3.x before 3.1.0, psa_cipher_generate_iv and psa_cipher_encrypt allow policy bypass or oracle-based decryption when the output buffer is at memory locations accessible to an untrusted application.


CVE ID: CVE-2022-35409 Severity: CRITICAL (CVSS 9.1) CWE: CWE-125 Affected: cpe:2.3:a:arm:mbed_tls:*:*:*:*:*:*:*:*, cpe:2.3:a:trustedfirmware:mbed_tls:*:*:*:*:*:*:*:*, cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* KEV (actively exploited): NO Description: An issue was discovered in Mbed TLS before 2.28.1 and 3.x before 3.2.0. In some configurations, an unauthenticated attacker can send an invalid ClientHello message to a DTLS server that causes a heap-based buffer over-read of up to 255 bytes. This can cause a server crash or possibly information disclosure based on error responses. Affected configurations have MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE enabled and MBEDTLS_SSL_IN_CONTENT_LEN less than a threshold that depends on the configuration: 258 bytes if using mbedtls_ssl_cookie_check, and possibly up to 571 bytes with a custom cookie check function.


CVE ID: CVE-2022-46392 Severity: MEDIUM (CVSS 5.3) CWE: CWE-203 Affected: cpe:2.3:a:arm:mbed_tls:*:*:*:*:*:*:*:*, cpe:2.3:a:trustedfirmware:mbed_tls:*:*:*:*:*:*:*:*, cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*, cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* KEV (actively exploited): NO Description: An issue was discovered in Mbed TLS before 2.28.2 and 3.x before 3.3.0. An adversary with access to precise enough information about memory accesses (typically, an untrusted operating system attacking a secure enclave) can recover an RSA private key after observing the victim performing a single private-key operation, if the window size (MBEDTLS_MPI_WINDOW_SIZE) used for the exponentiation is 3 or smaller.


CVE ID: CVE-2022-46393 Severity: CRITICAL (CVSS 9.8) CWE: CWE-125, CWE-787 Affected: cpe:2.3:a:arm:mbed_tls:*:*:*:*:*:*:*:*, cpe:2.3:a:trustedfirmware:mbed_tls:*:*:*:*:*:*:*:*, cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*, cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* KEV (actively exploited): NO Description: An issue was discovered in Mbed TLS before 2.28.2 and 3.x before 3.3.0. There is a potential heap-based buffer overflow and heap-based buffer over-read in DTLS if MBEDTLS_SSL_DTLS_CONNECTION_ID is enabled and MBEDTLS_SSL_CID_IN_LEN_MAX > 2 * MBEDTLS_SSL_CID_OUT_LEN_MAX.


CVE ID: CVE-2021-36647 Severity: MEDIUM (CVSS 4.7) CWE: CWE-327 Affected: cpe:2.3:a:arm:mbed_tls:*:*:*:*:*:*:*:*, cpe:2.3:a:trustedfirmware:mbed_tls:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Use of a Broken or Risky Cryptographic Algorithm in the function mbedtls_mpi_exp_mod() in lignum.c in Mbed TLS Mbed TLS all versions before 3.0.0, 2.27.0 or 2.16.11 allows attackers with access to precise enough timing and memory access information (typically an untrusted operating system attacking a secure enclave such as SGX or the TrustZone secure world) to recover the private keys used in RSA.


CVE ID: CVE-2023-43615 Severity: HIGH (CVSS 7.5) CWE: CWE-120 Affected: cpe:2.3:a:arm:mbed_tls:*:*:*:*:*:*:*:*, cpe:2.3:a:trustedfirmware:mbed_tls:*:*:*:*:*:*:*:*, cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*, cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*, cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Mbed TLS 2.x before 2.28.5 and 3.x before 3.5.0 has a Buffer Overflow.


CVE ID: CVE-2023-45199 Severity: CRITICAL (CVSS 9.8) CWE: CWE-120 Affected: cpe:2.3:a:trustedfirmware:mbed_tls:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Mbed TLS 3.2.x through 3.4.x before 3.5 has a Buffer Overflow that can lead to remote Code execution.


CVE ID: CVE-2024-23744 Severity: HIGH (CVSS 7.5) CWE: CWE-400 Affected: cpe:2.3:a:trustedfirmware:mbed_tls:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: An issue was discovered in Mbed TLS 3.5.1. There is persistent handshake denial if a client sends a TLS 1.3 ClientHello without extensions.


CVE ID: CVE-2024-23170 Severity: MEDIUM (CVSS 5.5) CWE: CWE-203, CWE-385 Affected: cpe:2.3:a:arm:mbed_tls:*:*:*:*:*:*:*:*, cpe:2.3:a:trustedfirmware:mbed_tls:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: An issue was discovered in Mbed TLS 2.x before 2.28.7 and 3.x before 3.5.2. There was a timing side channel in RSA private operations. This side channel could be sufficient for a local attacker to recover the plaintext. It requires the attacker to send a large number of messages for decryption, as described in "Everlasting ROBOT: the Marvin Attack" by Hubert Kario.


CVE ID: CVE-2024-23775 Severity: HIGH (CVSS 7.5) CWE: CWE-190 Affected: cpe:2.3:a:arm:mbed_tls:*:*:*:*:*:*:*:*, cpe:2.3:a:trustedfirmware:mbed_tls:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Integer Overflow vulnerability in Mbed TLS 2.x before 2.28.7 and 3.x before 3.5.2, allows attackers to cause a denial of service (DoS) via mbedtls_x509_set_extension().


CVE ID: CVE-2024-28960 Severity: HIGH (CVSS 8.2) CWE: CWE-284 Affected: cpe:2.3:a:arm:mbed_crypto:*:*:*:*:*:*:*:*, cpe:2.3:a:arm:mbed_tls:*:*:*:*:*:*:*:*, cpe:2.3:a:trustedfirmware:mbed_tls:*:*:*:*:*:*:*:*, cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*, cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:* KEV (actively exploited): NO Description: An issue was discovered in Mbed TLS 2.18.0 through 2.28.x before 2.28.8 and 3.x before 3.6.0, and Mbed Crypto. The PSA Crypto API mishandles shared memory.


CVE ID: CVE-2024-28755 Severity: MEDIUM (CVSS 6.5) CWE: CWE-326 Affected: cpe:2.3:a:trustedfirmware:mbed_tls:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: An issue was discovered in Mbed TLS 3.5.x before 3.6.0. When an SSL context was reset with the mbedtls_ssl_session_reset() API, the maximum TLS version to be negotiated was not restored to the configured one. An attacker was able to prevent an Mbed TLS server from establishing any TLS 1.3 connection, potentially resulting in a Denial of Service or forced version downgrade from TLS 1.3 to TLS 1.2.


CVE ID: CVE-2024-28836 Severity: MEDIUM (CVSS 5.4) CWE: CWE-835 Affected: cpe:2.3:a:trustedfirmware:mbed_tls:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: An issue was discovered in Mbed TLS 3.5.x before 3.6.0. When negotiating the TLS version on the server side, it can fall back to the TLS 1.2 implementation of the protocol if it is disabled. If the TLS 1.2 implementation was disabled at build time, a TLS 1.2 client could put a TLS 1.3-only server into an infinite loop processing a TLS 1.2 ClientHello, resulting in a denial of service. If the TLS 1.2 implementation was disabled at runtime, a TLS 1.2 client can successfully establish a TLS 1.2 connection with the server.


CVE ID: CVE-2024-30166 Severity: CRITICAL (CVSS 9.1) CWE: CWE-121 Affected: cpe:2.3:a:trustedfirmware:mbed_tls:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: In Mbed TLS 3.3.0 through 3.5.2 before 3.6.0, a malicious client can cause information disclosure or a denial of service because of a stack buffer over-read (of less than 256 bytes) in a TLS 1.3 server via a TLS 3.1 ClientHello.


CVE ID: CVE-2024-45157 Severity: MEDIUM (CVSS 5.1) CWE: CWE-696 Affected: cpe:2.3:a:trustedfirmware:mbed_tls:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: An issue was discovered in Mbed TLS before 2.28.9 and 3.x before 3.6.1, in which the user-selected algorithm is not used. Unlike previously documented, enabling MBEDTLS_PSA_HMAC_DRBG_MD_TYPE does not cause the PSA subsystem to use HMAC_DRBG: it uses HMAC_DRBG only when MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG and MBEDTLS_CTR_DRBG_C are disabled.


CVE ID: CVE-2024-45158 Severity: CRITICAL (CVSS 9.8) CWE: CWE-121 Affected: cpe:2.3:a:trustedfirmware:mbed_tls:3.6.0:*:*:*:*:*:*:* KEV (actively exploited): NO Description: An issue was discovered in Mbed TLS 3.6 before 3.6.1. A stack buffer overflow in mbedtls_ecdsa_der_to_raw() and mbedtls_ecdsa_raw_to_der() can occur when the bits parameter is larger than the largest supported curve. In some configurations with PSA disabled, all values of bits are affected. (This never happens in internal library calls, but can affect applications that call these functions directly.)


CVE ID: CVE-2024-45159 Severity: CRITICAL (CVSS 9.8) CWE: CWE-295 Affected: cpe:2.3:a:trustedfirmware:mbed_tls:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: An issue was discovered in Mbed TLS 3.x before 3.6.1. With TLS 1.3, when a server enables optional authentication of the client, if the client-provided certificate does not have appropriate values in if keyUsage or extKeyUsage extensions, then the return value of mbedtls_ssl_get_verify_result() would incorrectly have the MBEDTLS_X509_BADCERT_KEY_USAGE and MBEDTLS_X509_BADCERT_KEY_USAGE bits clear. As a result, an attacker that had a certificate valid for uses other than TLS client authentication would nonetheless be able to use it for TLS client authentication. Only TLS 1.3 servers were affected, and only with optional authentication (with required authentication, the handshake would be aborted with a fatal alert).


CVE ID: CVE-2024-49195 Severity: CRITICAL (CVSS 9.8) CWE: CWE-787 Affected: cpe:2.3:a:trustedfirmware:mbed_tls:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Mbed TLS 3.5.x through 3.6.x before 3.6.2 has a buffer underrun in pkwrite when writing an opaque key pair