Total
9259 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-34691 | 5 Adobe, Apple, Google and 2 more | 6 Experience Manager, Iphone Os, Macos and 3 more | 2026-07-29 | N/A | 9.3 CRITICAL |
| Adobe Experience Manager Forms JEE versions LTS SP1, 6.5.24.0 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed. | |||||
| CVE-2026-34693 | 5 Adobe, Apple, Google and 2 more | 6 Experience Manager, Iphone Os, Macos and 3 more | 2026-07-29 | N/A | 8.0 HIGH |
| Adobe Experience Manager Forms JEE versions LTS SP1, 6.5.24.0 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed. | |||||
| CVE-2026-0011 | 1 Google | 1 Android | 2026-07-29 | N/A | 8.4 HIGH |
| In enableSystemPackageLPw of Settings.java, there is a possible way to prevent location access from working due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | |||||
| CVE-2026-0009 | 1 Google | 1 Android | 2026-07-28 | N/A | 7.8 HIGH |
| In multiple locations, there is a possible tapjacking due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | |||||
| CVE-2026-0010 | 1 Google | 1 Android | 2026-07-28 | N/A | 8.4 HIGH |
| In onTransact of IDrmManagerService.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | |||||
| CVE-2025-71256 | 2 Google, Unisoc | 5 Android, T8100, T8200 and 2 more | 2026-07-25 | N/A | 7.5 HIGH |
| In nr modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed. | |||||
| CVE-2025-71253 | 2 Google, Unisoc | 17 Android, Sc7731e, Sc9832e and 14 more | 2026-07-25 | N/A | 7.5 HIGH |
| In Modem IMS, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed. | |||||
| CVE-2025-71251 | 2 Google, Unisoc | 17 Android, Sc7731e, Sc9832e and 14 more | 2026-07-25 | N/A | 7.5 HIGH |
| In IMS, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. | |||||
| CVE-2026-0049 | 1 Google | 1 Android | 2026-07-24 | N/A | 6.2 MEDIUM |
| In onHeaderDecoded of LocalImageResolver.java, there is a possible persistent denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. | |||||
| CVE-2026-16419 | 1 Google | 2 Android, Chrome | 2026-07-24 | N/A | 9.6 CRITICAL |
| Out of bounds read and write in ANGLE in Google Chrome on Android prior to 150.0.7871.182 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) | |||||
| CVE-2026-15900 | 1 Google | 2 Android, Chrome | 2026-07-24 | N/A | 9.6 CRITICAL |
| Use after free in GPU in Google Chrome on Android prior to 150.0.7871.128 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical) | |||||
| CVE-2026-16424 | 1 Google | 2 Android, Chrome | 2026-07-24 | N/A | 9.6 CRITICAL |
| Use after free in GPU in Google Chrome on Android prior to 150.0.7871.182 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) | |||||
| CVE-2026-9123 | 2 Google, Linux | 4 Android, Chrome, Chrome Os and 1 more | 2026-07-23 | N/A | 7.5 HIGH |
| Heap buffer overflow in Chromecast in Google Chrome on Android, Linux, ChromeOS prior to 148.0.7778.179 allowed a local attacker to execute arbitrary code inside a sandbox via malicious network traffic. (Chromium security severity: Medium) | |||||
| CVE-2026-34711 | 5 Adobe, Apple, Google and 2 more | 7 C2pa, C2pa-web, Iphone Os and 4 more | 2026-07-23 | N/A | 7.5 HIGH |
| CAI Content Credentials versions c2pa-web@0.7.1, c2pa-v0.80.1 and earlier are affected by an Integer Overflow or Wraparound vulnerability. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction. | |||||
| CVE-2026-34657 | 5 Adobe, Apple, Google and 2 more | 7 C2pa, C2pa-web, Iphone Os and 4 more | 2026-07-23 | N/A | 5.5 MEDIUM |
| CAI Content Credentials versions c2pa-web@0.7.1, c2pa-v0.80.1 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in an arbitrary file system write. An attacker could leverage this vulnerability to write to unauthorized files or directories outside of intended restrictions. Exploitation of this issue requires user interaction in that a victim must extract a maliciously crafted file. | |||||
| CVE-2026-11672 | 1 Google | 2 Android, Chrome | 2026-07-23 | N/A | 8.3 HIGH |
| Heap buffer overflow in GPU in Google Chrome on Android prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) | |||||
| CVE-2026-11647 | 1 Google | 2 Android, Chrome | 2026-07-23 | N/A | 8.3 HIGH |
| Use after free in Printing in Google Chrome on Android prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) | |||||
| CVE-2026-34694 | 5 Adobe, Apple, Google and 2 more | 6 Experience Manager, Iphone Os, Macos and 3 more | 2026-07-23 | N/A | 4.8 MEDIUM |
| Adobe Experience Manager Forms JEE versions LTS SP1, 6.5.24.0 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed. | |||||
| CVE-2026-11163 | 1 Google | 2 Android, Chrome | 2026-07-23 | N/A | 9.6 CRITICAL |
| Use after free in Messages in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-11172 | 1 Google | 2 Android, Chrome | 2026-07-23 | N/A | 8.8 HIGH |
| Incorrect security UI in Contact Picker in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium) | |||||