Total
690 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-17936 | 1 Google | 1 Chrome | 2026-07-30 | 6.5 Medium |
| Inappropriate implementation in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-17677 | 1 Google | 1 Chrome | 2026-07-30 | 8.8 High |
| Inappropriate implementation in ANGLE in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-17710 | 1 Google | 1 Chrome | 2026-07-30 | 9.6 Critical |
| Inappropriate implementation in MHTML in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-17695 | 1 Google | 1 Chrome | 2026-07-30 | 9.6 Critical |
| Inappropriate implementation in ANGLE in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-67427 | 1 Flytohub | 1 Flyto-core | 2026-07-30 | 8.6 High |
| Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, the workflow engine variable resolver expands ${env.VAR} for any host environment variable without an allowlist or capability policy check, allowing a workflow parameter to bypass the default capability policy denylist for env.get and env.load_dotenv and exfiltrate secrets through allowed modules. This issue is fixed in version 2.26.6. | ||||
| CVE-2026-17899 | 1 Google | 1 Chrome | 2026-07-30 | 8.8 High |
| Insufficient policy enforcement in DevTools in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to perform privilege escalation via a crafted Chrome Extension. (Chromium security severity: Low) | ||||
| CVE-2026-17919 | 1 Google | 1 Chrome | 2026-07-30 | 6.8 Medium |
| Insufficient policy enforcement in Enterprise in Google Chrome on Mac prior to 151.0.7922.72 allowed a local attacker to perform privilege escalation via physical access to the device. (Chromium security severity: Low) | ||||
| CVE-2025-50330 | 1 Zipgenius | 1 Zipgenius | 2026-07-30 | 8.8 High |
| An issue in ZipGenius Team ZipGenius v.6.3.2.3116 and before allows a remote attacker to escalate privileges and execute arbitrary code via the zipgenius.exe. | ||||
| CVE-2026-13904 | 1 Google | 1 Chrome | 2026-07-29 | 6.5 Medium |
| Inappropriate implementation in Safe Browsing in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-13910 | 1 Google | 1 Chrome | 2026-07-29 | 6.5 Medium |
| Insufficient policy enforcement in WebXR in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-46634 | 1 Twigphp | 1 Twig | 2026-07-29 | N/A |
| Twig is a template language for PHP. From 3.9.0 until 3.26.0, template_from_string() compiles an inner template under a synthesized __string_template__<hash> name that can fall outside a SourcePolicyInterface sandbox decision, allowing a sandboxed template that can call template_from_string and include to render an inner template without security policy enforcement. This issue is fixed in version 3.26.0. | ||||
| CVE-2025-50327 | 1 Fcorbelli | 1 Zpaqfranz | 2026-07-28 | 8.8 High |
| An issue in Franco Corbelli ZPAQFRANZ v.61.3 and before allows a remote attacker to escalate privileges and execute arbitrary code via a bypass of the Mark-of-the-Web protection mechanism | ||||
| CVE-2026-28900 | 1 Apple | 1 Macos | 2026-07-28 | 5.5 Medium |
| A file quarantine bypass was addressed with additional checks. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8. A maliciously crafted ZIP archive may bypass Gatekeeper checks. | ||||
| CVE-2026-64728 | 1 Apple | 6 Ios And Ipados, Macos, Safari and 3 more | 2026-07-28 | 6.5 Medium |
| A permissions issue was addressed with improved validation. This issue is fixed in Safari 26.6, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Maliciously crafted web content may violate iframe sandboxing policy. | ||||
| CVE-2026-28912 | 1 Apple | 1 Macos | 2026-07-28 | 7.8 High |
| A logic issue was addressed with improved restrictions. This issue is fixed in macOS Sequoia 15.7.8, macOS Tahoe 26.6. A user may be able to elevate privileges. | ||||
| CVE-2026-56585 | 1 Hcltech | 1 Intelliops Event Management | 2026-07-27 | 3.1 Low |
| HCL IEM was affected with the Anti Clickjacking XFrame Options Header Missing. It may allow attackers to embed the application in malicious pages and induce unauthorized user actions. | ||||
| CVE-2026-66391 | 1 Apache | 1 Wicket | 2026-07-27 | 6.5 Medium |
| Use of Insufficiently Random Values, Protection Mechanism Failure vulnerability in Apache Wicket. This issue affects Apache Wicket: from 9.0.0 through 9.23.0, from 10.0.0 through 10.9.0. Users are recommended to upgrade to version 10.10.0, which fixes the issue. | ||||
| CVE-2026-28914 | 1 Apple | 1 Macos | 2026-07-27 | 5.5 Medium |
| A logic issue was addressed with improved file handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.5. A maliciously crafted ZIP archive may bypass Gatekeeper checks. | ||||
| CVE-2026-65899 | 1 Cure53 | 1 Dompurify | 2026-07-27 | 6.1 Medium |
| DOMPurify 3.0.0 before 3.4.9 does not reset the retained Trusted Types policy when clearConfig() is called, so a DOMPurify instance reused across trust boundaries stays bound to a previously supplied TRUSTED_TYPES_POLICY. A later caller that requests RETURN_TRUSTED_TYPE output receives a TrustedHTML object created by the old (potentially unsafe) policy rather than a clean default, which can lead to script execution at a Trusted Types sink. Passing TRUSTED_TYPES_POLICY: null on the later call also does not clear the retained policy. | ||||
| CVE-2026-16380 | 1 Mozilla | 1 Firefox | 2026-07-27 | 9.1 Critical |
| Mitigation bypass in the Networking component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. | ||||