Published threat advisories for July 30, 2026

A command injection vulnerability exists in the `net.set_wan` interface of certain networking devices. Reachable via the internet, this flaw could permit unauthenticated attackers to execute arbitrary commands with root privileges on affected devices, potentially leading to a complete compromise. Confirming the presenc

NVD modified: NVD date unavailable

LazyOwn's AI-powered C2 framework has a vulnerability where default credentials allow network-reachable attackers unauthenticated operator-level access to its dashboard. This could enable unauthorized control over the framework's operations.

NVD modified: NVD date unavailable

A critical vulnerability in the LazyOwn RedTeam/APT Framework allows unauthenticated remote code execution. If reachable, this could enable unauthorized command execution within the C2 process, posing a risk to system integrity. Confirmation of the framework's usage and exposure is advised.

NVD modified: NVD date unavailable

Improper access control in Azure Cosmos DB, a cloud database service, allows unauthorized network access to execute code. This vulnerability could impact the confidentiality, integrity, and availability of the database. Confirming the use of this service and assessing potential exposure is a key concern.

NVD modified: NVD date unavailable

OpenClaw Dashboard has a stored cross-site scripting vulnerability allowing unauthenticated remote attackers to inject HTML and script via a crafted username during a failed login attempt. If an administrator views the audit log, the injected code can execute in their session, potentially allowing unauthorized interact

NVD modified: NVD date unavailable

A hardcoded secret in Outstatic CMS allows unauthenticated attackers to forge session tokens and gain administrative access. This vulnerability could lead to unauthorized control over the content management system and access to user data. Confirming usage and exposure is crucial.

NVD modified: NVD date unavailable

A flaw in a DNS management tool's ping function allows a local attacker to execute arbitrary code. The issue could affect system data and service behavior if a local user can trigger the vulnerable function. Confirmation of the tool's presence and reachability within the environment is the initial concern.

NVD modified: NVD date unavailable

SourceCodester Tailor Management System is affected by a critical SQL injection vulnerability in customeredit.php. This flaw allows unauthenticated attackers to potentially access, modify, or delete sensitive customer data. Organizations using this system should confirm its presence and assess potential impact.

NVD modified: NVD date unavailable

A SQL injection vulnerability exists in a web-based tailor management system, potentially allowing attackers to execute malicious database commands over the network. This could lead to unauthorized access, modification, or deletion of sensitive data stored within the system. It is important to determine if this system

NVD modified: NVD date unavailable

A critical SQL injection vulnerability exists in the CodeAstro Membership Management System's renewal functionality, allowing unauthenticated attackers to potentially access, modify, or delete sensitive membership data. Organizations should identify any usage of this system and assess its reachability and criticality.

NVD modified: NVD date unavailable

A critical SQL injection vulnerability exists in the CodeAstro Membership Management System's `edit_type.php` endpoint. This flaw may permit unauthenticated attackers to execute arbitrary database commands, potentially leading to unauthorized access or modification of sensitive membership data if the system is external

NVD modified: NVD date unavailable

A SQL injection vulnerability in a membership management system allows unauthenticated attackers to potentially access, alter, or delete sensitive data by manipulating web requests to the `/edit_member.php` script. This could compromise member data and system integrity, requiring confirmation of system usage and exposu

NVD modified: NVD date unavailable

A SQL injection vulnerability exists in the CodeAstro Membership Management System's reporting features, allowing unauthenticated attackers to manipulate database queries. This could lead to unauthorized access, modification, or deletion of sensitive membership data. The system's web interface is likely exposed to the

NVD modified: NVD date unavailable

A critical SQL injection vulnerability exists in the CodeAstro Membership Management System that could allow attackers to manipulate member data. If this system is reachable, unauthenticated actors could potentially read, modify, or delete sensitive information from the database. Confirming usage and external exposure

NVD modified: NVD date unavailable

A SQL injection vulnerability exists in the CodeAstro Membership Management System, allowing unauthenticated network attackers to execute malicious SQL commands. This could lead to unauthorized access, modification, or deletion of sensitive membership data. The issue is in a web-accessible endpoint, suggesting potentia

NVD modified: NVD date unavailable

A critical SQL Injection vulnerability exists in the CodeAstro Membership Management System's membership card printing function, potentially allowing unauthorized access and modification of sensitive data. The issue involves the `print_membership_card.php` script and requires network access for exploitation. This could

NVD modified: NVD date unavailable

A SQL injection vulnerability exists in an e-commerce application's product price display script, potentially allowing attackers to access or modify sensitive database information. This issue is classified as external and critical, meaning it is reachable via the network. The vulnerability is in a file designed to show

NVD modified: NVD date unavailable

A critical vulnerability exists in Spikster where missing authentication allows unauthenticated remote attackers to access API routes. This could enable attackers to enumerate servers, reset passwords, access files, and create database users. Confirming relevance is key, as these API endpoints often manage sensitive fu

NVD modified: NVD date unavailable

Juggle contains a critical remote code execution vulnerability accessible via its H2 database web console using default credentials. This allows unauthenticated attackers to run arbitrary OS commands, potentially leading to root-level code execution. The technology is vulnerable if the H2 console is exposed and reachab

NVD modified: NVD date unavailable

A critical vulnerability exists in IBM Langflow OSS, a tool for building AI workflows, where improper handling of user input could allow an unauthenticated remote attacker to inject and execute arbitrary code on the system. This could lead to system compromise, affecting data integrity and availability. It is important

NVD modified: NVD date unavailable

A vulnerability in the Action Pack framework allows a crafted upload to invoke unsafe libvips operations, potentially exposing sensitive files and credentials. This could enable remote code execution or lateral movement if the application uses libvips and accepts untrusted image uploads.

NVD modified: NVD date unavailable

A heap-based buffer overflow vulnerability in the schreibfaul1 ESP32-audioI2S library's character encoding function could allow an attacker to execute code, disclose information, or cause a denial of service. This occurs if the library processes malicious, oversized input, leading to an out-of-bounds write. The actual

NVD modified: NVD date unavailable

Activepieces, an open-source AI workflow automation platform, has a vulnerability where an authenticated flow author can access and modify cached files of other tenants on the same worker. This could lead to sensitive data exposure and the execution of malicious code on a victim tenant's next flow run.

NVD modified: NVD date unavailable

SGLang contains a critical remote code execution vulnerability when loading model weights from HuggingFace repositories, enabling attackers to deserialize malicious code in .bin files. This could allow arbitrary code execution on the affected system if reachable. Confirming the exposure and relevance of deployed SGLang

NVD modified: NVD date unavailable

A critical vulnerability in SGLang's optional dumper subsystem, when enabled and configured with a specific server port, may allow for sandbox escape and remote code execution through inference requests. This could permit an attacker to run unauthorized code on the affected system. The key concern is to determine if th

NVD modified: NVD date unavailable

SGLang, a framework for large language model serving, contains a critical vulnerability allowing unauthenticated command execution via crafted payloads that bypass an incomplete denylist. This flaw could compromise system integrity and data if the affected technology is reachable.

NVD modified: NVD date unavailable

IBM Langflow OSS contains an improper input validation vulnerability in its PythonREPL sandbox. If reachable and exploited, this could allow an attacker to execute arbitrary code, potentially leading to unauthorized access and manipulation. Organizations using this technology should confirm its presence and assess pote

NVD modified: NVD date unavailable

IBM Hardware Management Console software contains a vulnerability allowing unauthenticated users to execute arbitrary commands with elevated privileges due to improper input validation. This could impact system data and behavior if the console is network-reachable, affecting critical administrative interfaces for IBM P

NVD modified: NVD date unavailable

A critical vulnerability exists in IBM webMethods Integration, allowing unauthenticated remote attackers to execute arbitrary code by deserializing untrusted data. This could compromise system integrity and confidentiality if the integration platform is reachable.

NVD modified: NVD date unavailable

A critical use-after-free vulnerability exists in the JSON cache management module of SQLite. If reachable, this flaw could allow an attacker to corrupt, modify, or disclose data processed by applications using this library. Understanding the extent to which your systems utilize SQLite for JSON processing is essential

NVD modified: NVD date unavailable

A use-after-free vulnerability exists in SQLite's shared cache lock management, potentially leading to denial of service or sensitive memory disclosure. This flaw arises from improperly freeing memory while it's still in use within the btree module's linked list. Although SQLite is typically embedded and not directly e

NVD modified: NVD date unavailable

IBM Langflow OSS is vulnerable to unauthenticated remote code execution through environment variable injection in its MCP stdio launcher. An attacker could exploit this to run unauthorized commands on affected systems, potentially impacting operations and data integrity. It is important to confirm if this technology is

NVD modified: NVD date unavailable

Apache Kyuubi's REST batch upload handling contains a path traversal vulnerability. A remote attacker could exploit this to write controlled content to arbitrary filesystem locations, subject to server permissions. This could impact system integrity. Confirm if Kyuubi is in use and assess its exposure.

NVD modified: NVD date unavailable

A SQL injection vulnerability exists in the UMAI Vision Traffic Analysis System, potentially allowing attackers to execute unauthorized SQL commands. This could lead to data manipulation or system disruption. Uncertainty exists regarding specific affected versions and the extent of potential business impact.

NVD modified: NVD date unavailable

A critical vulnerability in Apache JSPWiki's UserManager allows for privilege escalation, potentially enabling attackers to impersonate users due to a lack of input validation. This could lead to unauthorized access and modification of sensitive wiki content. Organizations should identify all instances of the software,

NVD modified: NVD date unavailable

A critical SAML authentication bypass vulnerability affects SolarWinds Web Help Desk when SAML 2.0 is enabled. Reachable instances could allow unauthenticated attackers to bypass login controls, potentially leading to unauthorized system access. This warrants confirmation of product usage and exposure within your envir

NVD modified: NVD date unavailable

An authentication bypass vulnerability in the malach-it Boruta library allows attackers to replay expired JWT client assertions to impersonate OAuth clients and gain unauthorized access. This could enable access to client resources with the client's privileges. The issue is considered critical and affects systems using

NVD modified: NVD date unavailable

A critical directory traversal vulnerability in IBM App Connect Enterprise could allow remote attackers to write arbitrary files to the system via specially crafted URL requests. This affects system integrity and could lead to further compromise if the affected product is exposed externally. Confirmation of deployed in

NVD modified: NVD date unavailable

A cross-site scripting vulnerability exists in the administrative console login page of IBM Tivoli System Automation Application Manager and IBM WebSphere Application Server. This could allow an attacker to inject malicious scripts, potentially leading to unauthorized actions or information disclosure within a user's s

NVD modified: NVD date unavailable

A directory traversal vulnerability exists in VMware vCenter's Syslog server, potentially allowing an unauthenticated attacker with network access to execute arbitrary code. The severity is high, but the actual risk depends on whether the Syslog service is exposed to untrusted networks.

NVD modified: NVD date unavailable

VMware vCenter's Directory Service has an authentication bypass vulnerability, allowing unauthenticated network-accessible actors to gain unauthorized system access. This could impact the management of virtualized infrastructure.

NVD modified: NVD date unavailable

CentreStack contains a hardcoded cryptographic key vulnerability, allowing unauthenticated attackers to forge encrypted tokens and access privileged API endpoints. This could enable domain administrator privileges and unauthenticated remote code execution. Confirmation of system relevance and exposure is advised due to

NVD modified: NVD date unavailable

A logic flaw in osTicket's password reset function allows attackers to bypass expiry checks if they obtain a valid reset token, potentially leading to unauthorized account takeovers. This vulnerability in the token validation routine means that tokens with existing timestamps might not be properly validated for expirat

NVD modified: NVD date unavailable

A critical vulnerability exists where improper handling of special elements allows an unauthenticated remote attacker to inject commands into system configurations, which are then executed as root. This could lead to unauthorized system-level modifications and potential compromise. The issue is relevant if the affected

NVD modified: NVD date unavailable

A flaw in the firewall's script execution order during shutdown creates a temporary window where internal services may become accessible externally, potentially allowing an unauthenticated remote attacker to gain full system compromise.

NVD modified: NVD date unavailable

A critical vulnerability exists in charging controller basemodule firmware updates, where a lack of cryptographic signature verification allows unauthenticated remote attackers to install modified firmware, potentially leading to full system compromise. The main concern is confirming the relevance and exposure of this

NVD modified: NVD date unavailable

A critical vulnerability exists in the CHARX OCPP Agent service, allowing unauthenticated remote attackers to reconfigure its backend connection, potentially causing denial-of-service and disclosing confidential data.

NVD modified: NVD date unavailable

An unauthenticated remote attacker can access an MQTT broker due to missing authentication, potentially leading to full device compromise. Although protected by a firewall, a bypass could expose this critical vulnerability. Leaders should confirm if this technology is in use and assess its potential exposure and impact

NVD modified: NVD date unavailable

A vulnerability in the Plesk XML-RPC API allows authenticated users to inject SQL commands, potentially enabling them to read sensitive data from the Plesk database and achieve full control over the hosting panel. This issue is relevant for organizations using Plesk for web hosting management and requires attention to

NVD modified: NVD date unavailable

An unauthenticated deserialization vulnerability in the Remote API WordPress plugin allows attackers to inject malicious code, potentially leading to remote code execution if a suitable gadget chain is present. This could impact the integrity and availability of affected websites and their data.

NVD modified: NVD date unavailable

The Admin and Site Enhancements Pro WordPress plugin has a critical vulnerability that allows unauthenticated attackers to execute code remotely. This is possible because a frontend save handler lacks authentication and validation, and input is processed without sanitization before being used in an eval() call. Exploit

NVD modified: NVD date unavailable

Adobe Campaign Classic has an incorrect authorization flaw that may allow arbitrary code execution without user interaction. This could impact system data and service behavior if the application is reachable over the network.

NVD modified: NVD date unavailable

An inappropriate implementation in the Tint component of Google Chrome on Mac could allow a remote attacker to escape the browser's sandbox via a crafted HTML page. This vulnerability requires user interaction with a malicious website, and while the Chromium security severity is low, it presents a potential risk of una

NVD modified: NVD date unavailable

A vulnerability in Google Lens within Chrome allows a sandbox escape via a crafted HTML page, potentially impacting the renderer process. This could grant attackers broader system access if they have already compromised the renderer process and a user interacts with a malicious page. While the Chromium security severit

NVD modified: NVD date unavailable

A vulnerability in AI features within Google Chrome could allow a sophisticated attacker, who has already compromised the renderer process, to escape the browser's sandbox via a crafted HTML page, potentially affecting system data and service behavior.

NVD modified: NVD date unavailable

A vulnerability in Google Chrome's WebAuthn feature may allow a remote attacker who has already compromised the renderer process to escape the browser's sandbox by using a crafted PDF file. This issue is related to insufficient validation of untrusted input. While a prior compromise is necessary, successful exploitatio

NVD modified: NVD date unavailable

A vulnerability in Google Chrome's notification handling could allow an attacker who has already compromised the renderer process to escape the browser's sandbox using a crafted PDF. This could potentially lead to broader system access.

NVD modified: NVD date unavailable

A use-after-free vulnerability exists in Google Chrome's WebSockets, potentially allowing a remote attacker to escape the browser's sandbox by tricking a user into visiting a crafted HTML page. This could enable an attacker to execute code outside the browser's security boundaries. The relevance and exposure of this cl

NVD modified: NVD date unavailable

Google Chrome on Android has a vulnerability in its Picture-in-Picture feature where insufficient input validation could allow a remote attacker, who has compromised the renderer process, to escape the browser sandbox via a crafted HTML page. This could potentially expose system data and alter service behavior, though

NVD modified: NVD date unavailable

A use-after-free vulnerability exists in the DNS component of Google Chrome, which could allow an attacker who has already compromised the renderer process to escape the browser's sandbox. This could potentially lead to unauthorized code execution on the affected system. The primary concern is to determine if this tech

NVD modified: NVD date unavailable

A vulnerability in Google Chrome's crypto implementation could allow a remote attacker to escape the browser sandbox via a crafted HTML page. This requires prior compromise of the renderer process and user interaction with a malicious site, potentially impacting system or user data accessible from within the sandbox.

NVD modified: NVD date unavailable

A vulnerability in Google Chrome on Mac could allow a remote attacker to escape the browser's sandbox via a crafted HTML page, potentially leading to unauthorized system access. This requires a user to visit a malicious webpage to compromise the renderer process. It is uncertain if specific environments are exposed to

NVD modified: NVD date unavailable

A race condition in Google Chrome's DevTools on Mac may allow a compromised renderer process to escape the browser's sandbox. If reachable, this could lead to unauthorized access or modification of data. The relevance and exposure to our environment are currently being assessed.

NVD modified: NVD date unavailable

An integer overflow in Google Chrome's codecs could allow a remote attacker to escape the browser sandbox by tricking a user into opening a crafted video file. This could potentially lead to unauthorized system actions, though user interaction is required. The relevance to your environment depends on users opening such

NVD modified: NVD date unavailable

A vulnerability in Google Chrome's ANGLE component could allow a remote attacker to escape the browser sandbox via a crafted HTML page. This could potentially impact the integrity and confidentiality of local system data if a user navigates to a malicious page.

NVD modified: NVD date unavailable

A vulnerability in Google Chrome's developer tools allows a compromised renderer process to potentially escape the browser sandbox via a crafted HTML page. This could enable an attacker to execute higher-privileged code on the user's system.

NVD modified: NVD date unavailable

A security vulnerability in Google Chrome's password handling could allow a compromised renderer process to escape the browser's sandbox via a crafted HTML page. This could potentially expose sensitive user data or allow for further system compromise if a user visits a malicious web page. The relevance and exposure of

NVD modified: NVD date unavailable

A use-after-free flaw in ANGLE, a component of Google Chrome, could allow a remote attacker to escape the browser's sandbox by tricking a user into visiting a crafted HTML page. This could potentially impact system integrity and confidentiality. Uncertainty exists regarding specific Chrome versions affected and the lik

NVD modified: NVD date unavailable

A use-after-free vulnerability in Google Chrome's media handling could allow a remote attacker to escape the browser's sandbox, potentially impacting data integrity and confidentiality. This vulnerability is triggered when a user visits a crafted HTML page, and its relevance depends on the use of this technology and po

NVD modified: NVD date unavailable

A security vulnerability in Google Chrome's Save to Drive feature could allow a compromised renderer process to escape the browser's sandbox by opening a crafted PDF file. This may impact system data and service behavior.

NVD modified: NVD date unavailable

A vulnerability in ANGLE, a component of Google Chrome, could allow a remote attacker to escape the browser's sandbox by using a crafted HTML page. This may lead to unauthorized access or control of the user's system. The risk to your environment depends on whether affected browser versions are reachable and process se

NVD modified: NVD date unavailable

A vulnerability in Google Chrome's WebSockets could allow a remote attacker, after compromising the browser's renderer, to escape the sandbox via a malicious HTML page, potentially impacting user data and system integrity. The risk is considered very unlikely as it requires user interaction with a crafted webpage.

NVD modified: NVD date unavailable

A heap buffer overflow in Google Chrome's Dawn component could allow a remote attacker to escape the browser sandbox via a crafted HTML page. This could potentially impact the confidentiality, integrity, and availability of a user's system.

NVD modified: NVD date unavailable

A critical vulnerability in Google Chrome for Android's WebGL component could allow attackers to escape the browser sandbox by tricking users into visiting a malicious HTML page. This could potentially lead to unauthorized access or manipulation of data on affected devices if reached.

NVD modified: NVD date unavailable

An integer overflow in Google Chrome's WebGL component on Android may allow a remote attacker to escape the browser sandbox via a crafted HTML page. This could potentially lead to unauthorized access to device functions or data.

NVD modified: NVD date unavailable

A vulnerability in ANGLE, a Google Chrome component, could allow a remote attacker to escape the browser's sandbox via a crafted HTML page. This requires user interaction, making it a lesser threat to infrastructure but still posing a risk if users access malicious content.

NVD modified: NVD date unavailable

A use-after-free vulnerability in ANGLE within Google Chrome may allow a remote attacker to escape the browser sandbox via a crafted HTML page. This could potentially lead to broader system compromise.

NVD modified: NVD date unavailable

A vulnerability in Google Chrome's ANGLE component allows a remote attacker to potentially escape the browser sandbox via a crafted HTML page, which could lead to broader system compromise.

NVD modified: NVD date unavailable

A vulnerability in Chrome for Android's accessibility features could allow a compromised attacker to escape the browser's sandbox via a crafted HTML page. This could potentially impact system data and service behavior.

NVD modified: NVD date unavailable

A race condition in Google Chrome on Macs allows a compromised renderer process to escape the browser's sandbox via a crafted HTML page. This could potentially impact system integrity and confidentiality. While direct reachability from the internet is considered unlikely, relevance should be confirmed.

NVD modified: NVD date unavailable

A vulnerability in Google Chrome's MHTML handling on Mac could allow an attacker who has already compromised the renderer process to escape the browser's sandbox. This could potentially impact system and user data.

NVD modified: NVD date unavailable

A race condition in Google Chrome on Mac allows a compromised renderer process to potentially escape the sandbox via a crafted HTML page. This vulnerability affects widely used browser technology and could lead to significant system compromise if exploited.

NVD modified: NVD date unavailable

A use-after-free vulnerability in Google Chrome's audio component could allow an attacker who has compromised the renderer process to escape the browser sandbox via a crafted HTML page. This could lead to broader system access.

NVD modified: NVD date unavailable

A use-after-free vulnerability in Google Chrome's ANGLE component could allow a remote attacker to escape the browser's sandbox via a crafted HTML page. This could impact system data and service behavior.

NVD modified: NVD date unavailable

A vulnerability in ANGLE for Google Chrome on Mac could allow a malicious website to escape the browser's security sandbox. This is due to insufficient validation of untrusted input, which could be triggered by a user visiting a compromised webpage, potentially leading to broader system compromise. The concern is to co

NVD modified: NVD date unavailable

A type confusion vulnerability in Google Chrome's ANGLE graphics engine could allow a remote attacker to escape the browser's sandbox via a malicious HTML page, potentially impacting system data confidentiality and integrity.

NVD modified: NVD date unavailable

A sandbox escape vulnerability in ANGLE, used by Google Chrome on Mac, could allow a remote attacker to bypass security protections via a crafted HTML page, potentially impacting the confidentiality and integrity of data. The vulnerability is rated as high severity.

NVD modified: NVD date unavailable

A use-after-free vulnerability in Google Chrome could allow a remote attacker to escape the browser's sandbox. This may occur if a user visits a malicious HTML page, potentially enabling unauthorized access to systems. The relevance to our environment requires confirmation.

NVD modified: NVD date unavailable

A vulnerability in ANGLE, a component within Google Chrome on Windows, could allow a remote attacker to escape the browser's sandbox via a crafted HTML page. This could potentially lead to unintended access or behavior within the system. The reader should care because this could result in broader system compromise.

NVD modified: NVD date unavailable

A use-after-free vulnerability in Google Chrome's input handling could allow a remote attacker, who has already compromised the renderer process, to escape the browser's sandbox via a crafted HTML page. This requires user interaction with a malicious website.

NVD modified: NVD date unavailable

A type confusion vulnerability in ANGLE, used in Google Chrome, allows a remote attacker to escape the browser sandbox via a malicious HTML page. This could lead to broader system compromise if a user is tricked into visiting such a page. The main concern is confirming the relevance and exposure of this client-side vul

NVD modified: NVD date unavailable

A vulnerability exists in Chrome for iOS's renderer process, allowing a remote attacker who has compromised it to potentially escape the browser's sandbox via a crafted HTML page. This could lead to unauthorized actions on the user's device.

NVD modified: NVD date unavailable

An integer overflow in ANGLE within Google Chrome allows a compromised renderer process to potentially escape the sandbox via a crafted HTML page. This could lead to elevated privileges or system compromise. The vulnerability's client-side nature and requirement for prior compromise make its direct reachability uncerta

NVD modified: NVD date unavailable

A vulnerability in Google Chrome on Android could allow a remote attacker who has compromised the renderer process to escape the browser's sandbox via a crafted HTML page. This requires user interaction with a malicious webpage.

NVD modified: NVD date unavailable

A heap buffer overflow in Google Chrome on ChromeOS could allow a remote attacker who has already compromised the renderer process to escape the browser's sandbox via a crafted HTML page. This could lead to broader system access. The issue requires chained exploits and is classified as high severity within Chromium.

NVD modified: NVD date unavailable

A vulnerability in ANGLE within Google Chrome on Android may permit an attacker who has compromised the renderer process to escape the browser sandbox via a crafted HTML page, potentially leading to broader system access. This is relevant due to the severe impact of sandbox escapes, although the attacker must first ach

NVD modified: NVD date unavailable

A critical vulnerability in Google Chrome's ANGLE component could allow a remote attacker who has compromised the renderer process to escape the browser sandbox via a crafted HTML page. This could affect system confidentiality, integrity, and availability. Confirming relevance to our environment is the initial priority

NVD modified: NVD date unavailable

A critical vulnerability exists in Google Chrome's QUIC implementation that could allow a compromised renderer process to escape its sandbox. An attacker could exploit this by tricking a user into visiting a malicious website. This may lead to unauthorized access to system data and service behavior.

NVD modified: NVD date unavailable

A vulnerability in Google Chrome's Chromecast component could allow a remote attacker to escape the browser's sandbox if they have already compromised the renderer process, potentially impacting system integrity and confidentiality.

NVD modified: NVD date unavailable

A high-severity vulnerability in ANGLE, a component of Google Chrome, could allow a sandbox escape via a crafted HTML page if an attacker compromises the renderer process. This could potentially lead to elevated access and affect system or user data. The issue's reachability depends on users visiting malicious webpages

NVD modified: NVD date unavailable

A use-after-free vulnerability in Google Chrome's rendering engine could allow a remote attacker to escape the browser's sandbox and potentially access system resources. This could occur if a user visits a malicious web page containing specially crafted code. The impact is not yet fully understood as exploitation detai

NVD modified: NVD date unavailable

An issue in Chrome for iOS could permit a remote attacker to escape the browser's sandbox via a malicious webpage. This could impact confidentiality, integrity, and availability. Assess relevance to confirm exposure.

NVD modified: NVD date unavailable

A cryptographic flaw in Google Chrome enables an attacker in a privileged network position to bypass access controls via malicious network traffic, potentially impacting data integrity. The threat is classified as external due to its network vector, but its direct enterprise impact is unlikely given its client-side nat

NVD modified: NVD date unavailable

A use-after-free vulnerability in Google Chrome's Ozone component could allow remote attackers to escape the browser sandbox. This requires a user to visit a malicious HTML page, potentially leading to unauthorized system access or manipulation.

NVD modified: NVD date unavailable

A vulnerability in Google Chrome's ANGLE component could allow a remote attacker to escape the browser sandbox via a malicious HTML page. This could potentially lead to broader system compromise. The reader should care to assess the relevance of this component in their environment.

NVD modified: NVD date unavailable

A critical vulnerability in Google Chrome's Views component may allow a remote attacker to escape the browser's security sandbox via a crafted HTML page, impacting system integrity and availability. This requires the attacker to first compromise the renderer process and trick a user into visiting a malicious webpage. T

NVD modified: NVD date unavailable

A critical vulnerability exists in Google Chrome on Android, stemming from insufficient validation of untrusted input in the Dawn component. This flaw could allow a remote attacker to escape the browser's sandbox by tricking a user into visiting a malicious HTML page. The potential impact could include significant comp

NVD modified: NVD date unavailable