Total
602 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-50329 | 2026-07-24 | N/A | 9.8 CRITICAL | ||
| An issue in ConeXware, Inc Power Archiver v.22.00.11 and before allows a remote attacker to escalate privileges and execute arbitrary code via the powerarc.exe. | |||||
| CVE-2025-50327 | 2026-07-24 | N/A | 8.8 HIGH | ||
| An issue in Franco Corbelli ZPAQFRANZ v.61.3 and before allows a remote attacker to escalate privileges and execute arbitrary code via a bypass of the Mark-of-the-Web protection mechanism | |||||
| CVE-2025-50325 | 2026-07-24 | N/A | 5.4 MEDIUM | ||
| BandiZip v.7.37 is affected by a Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of BandiZip | |||||
| CVE-2025-50324 | 2026-07-24 | N/A | 8.8 HIGH | ||
| An issue in Milos Paripovic OneCommander v.3.96.0.0 allows a remote attacker to execute arbitrary code via the OneCommander.exe component. | |||||
| CVE-2025-44090 | 2026-07-24 | N/A | 8.8 HIGH | ||
| An issue in OhSoft CoffeeZip v4.8.0.0 allows attackers to execute arbitrary code via downloading and executing a crafted archive file. | |||||
| CVE-2025-44089 | 2026-07-24 | N/A | 8.8 HIGH | ||
| An issue in NCH Software ExpressZip v11.29 allows attackers to execute arbitrary code via downloading and executing a crafted archive file. | |||||
| CVE-2026-16407 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-07-24 | N/A | 9.8 CRITICAL |
| Mitigation bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. | |||||
| CVE-2026-16388 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-07-24 | N/A | 9.8 CRITICAL |
| Sandbox escape in the DOM: Networking component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. | |||||
| CVE-2026-16382 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-07-24 | N/A | 9.8 CRITICAL |
| Mitigation bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. | |||||
| CVE-2026-16380 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-07-24 | N/A | 9.1 CRITICAL |
| Mitigation bypass in the Networking component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. | |||||
| CVE-2026-16370 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-07-24 | N/A | 9.1 CRITICAL |
| Mitigation bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. | |||||
| CVE-2026-16356 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-07-24 | N/A | 9.8 CRITICAL |
| Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. | |||||
| CVE-2026-16377 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-07-24 | N/A | 9.8 CRITICAL |
| Mitigation bypass in the PDF Viewer component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. | |||||
| CVE-2026-16383 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-07-24 | N/A | 9.8 CRITICAL |
| Mitigation bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. | |||||
| CVE-2026-16390 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-07-24 | N/A | 9.1 CRITICAL |
| Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. | |||||
| CVE-2026-50646 | 1 Microsoft | 17 .net, .net Framework, Visual Studio 2022 and 14 more | 2026-07-24 | N/A | 7.8 HIGH |
| Protection mechanism failure in .NET Framework allows an unauthorized attacker to execute code locally. | |||||
| CVE-2026-12214 | 2026-07-24 | 6.8 MEDIUM | 7.8 HIGH | ||
| A security flaw has been discovered in Qihoo 360 Total Security 6.0. This vulnerability affects the function RpcStringBindingComposeW of the component Nucleus Engine Monitoring Logic. Performing a manipulation of the argument NetworkAddr results in protection mechanism failure. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. | |||||
| CVE-2026-44451 | 2026-07-24 | N/A | 9.3 CRITICAL | ||
| Lumiverse is a full-featured AI chat application. Prior to 0.9.7, the component override system transpiles user-supplied TSX via Sucrase and evaluates it with new Function, shadowing dangerous globals (fetch, window, eval, etc.) with undefined. A static source validator (validateComponentOverrideSource) additionally blocks these identifiers by word-boundary regex. Both controls are bypassed. String-split bypass of the static validator: any blocked identifier can be reconstructed at runtime from string fragments ('ownerDoc' + 'ument'). DOM ref escape from the sandbox: useRef and useEffect are provided in scope. A ref attached to a rendered element gives a live DOM node. From any real DOM node, node['ownerDoc'+'ument']['def'+'aultView'] yields the real window, bypassing all identifier shadows. Theme packs (.lumitheme / .lumiverse-theme) are the shareable delivery mechanism. A malicious pack is an exploit path: the victim imports the file, enables one component override in the Theme Editor, and the payload fires in their authenticated session.This vulnerability is fixed in 0.9.7. | |||||
| CVE-2026-5903 | 4 Apple, Google, Linux and 1 more | 4 Macos, Chrome, Linux Kernel and 1 more | 2026-07-24 | N/A | 6.5 MEDIUM |
| Policy bypass in IFrameSandbox in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who convinced a user to engage in specific UI gestures to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low) | |||||
| CVE-2026-5900 | 4 Apple, Google, Linux and 1 more | 4 Macos, Chrome, Linux Kernel and 1 more | 2026-07-24 | N/A | 4.3 MEDIUM |
| Policy bypass in Downloads in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to bypass of multi-download protections via a crafted HTML page. (Chromium security severity: Low) | |||||