Skip to content

Threat feed

Security alerts

Notable vulnerabilities from public sources: new CISA KEV additions, critical CVEs (CVSS 9 or higher) and newly published public exploits. Updated continuously, newest first.

Search a CVE Atom feed

1,056 alerts · page 45 of 53

  1. Critical (CVSS 9+) Published · updated

    CVE-2026-118337 Chromium: CVE-2026-118337 Improper access control in Forms

    CriticalCVSS 9.3 EPSS 0.23%

    Exploit status: No public exploit known

    Affects: Microsoft edge chromium, Google Chrome, debian/chromium

    Use after free in Forms in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

  2. Critical (CVSS 9+) Published · updated

    CVE-2026-118340 Chromium: CVE-2026-118340 Memory corruption in Skia

    CriticalCVSS 9.6 EPSS 0.27%

    Exploit status: No public exploit known

    Affects: Microsoft edge chromium, redhat/webkit2gtk3, redhat/firefox and 6 more

    Integer overflow in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)

  3. Critical (CVSS 9+) Published · updated

    CVE-2026-118321 Chromium CVE-2026-118321: Use after free

    CriticalCVSS 9.6 EPSS 0.35%

    Exploit status: No public exploit known

    Affects: Microsoft edge chromium, debian/chromium, Google Chrome

    Use after free in Core in Google Chrome on on Android prior to 156.0.8078.73 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

  4. Critical (CVSS 9+) Published · updated

    CVE-2026-118305 Chromium: CVE-2026-118305 Memory corruption in Turbolev

    CriticalCVSS 9.6 EPSS 0.40%

    Exploit status: No public exploit known

    Affects: Microsoft edge chromium, Google Chrome, debian/chromium

    Type confusion in Turbolev in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

  5. Critical (CVSS 9+) Published · updated

    CVE-2026-118306 Chromium: CVE-2026-118306 Memory corruption in FileSystem

    CriticalCVSS 9.6 EPSS 0.37%

    Exploit status: No public exploit known

    Affects: Microsoft edge chromium, Google Chrome, debian/chromium

    Use after free in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

  6. Critical (CVSS 9+) Published · updated

    CVE-2026-58256 GRR vulnerable to Remote Code Execution Via PHP Code Injection

    CriticalCVSS 9.1 EPSS 0.58%

    Exploit status: No public exploit known

    Affects: JeromeDevome GRR

    GRR is a resource management and reservation application. Prior to the advisory-reported fixed version 4.5.0, an administrator can inject malicious PHP through LDAP connector configuration parameters such as ldap_filter, poisoning /personnalisation/config_ldap.inc.php and permitt...

  7. Critical (CVSS 9+) Published

    CVE-2026-123061 litellm: litellm: unauthenticated arbitrary file read leading to master key leakage and remote code execution

    CriticalCVSS 9.8

    Exploit status: No public exploit known

    Affects: redhat/exploit-intelligence/vulnerability-analysis-rhel9, redhat/lightspeed-core/lightspeed-stack-rhel9, redhat/ansible-automation-platform-26/lightspeed-chatbot-rhel9 and 6 more

    A critical vulnerability was discovered in LiteLLM Enterprise proxy where an unauthenticated remote attacker can trigger an arbitrary file read on any LLM route. This flaw allows an attacker to leak the proxy's master key (LITELLM_MASTER_KEY) and third-party model provider API cr...

  8. Critical (CVSS 9+) Published · updated

    CVE-2026-116692 MLflow: Remote code execution on unauthenticated MLflow servers via third-party scorer deserialization importing caller-placed artifact modules

    CriticalCVSS 9.8 EPSS 0.70%

    Exploit status: No public exploit known

    Affects: pypi mlflow, redhat/rhoai/odh-core-bff-rhel9, redhat/rhoai/odh-dashboard-operator-rhel9 and 30 more

    MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.12.0rc0 until 3.17.0, third-party scorer deserialization in mlflow/genai/scorers/base.py accepts request-selected descendants of THIRD_PARTY_SCORER_ALLOWED_MODU...

  9. Critical (CVSS 9+) Published · updated

    CVE-2026-112352 Sunhillo SureLine Authentication Bypass via Session Cookie

    CriticalCVSS 9.1 EPSS 1.5%

    Exploit status: No public exploit known

    Affects: Sunhillo Corporation SureLine

    Sunhillo SureLine before 9.1.5 contains an authentication bypass vulnerability that allows an unauthenticated remote attacker to impersonate any user with an active web session by forging a session cookie containing only a cleartext username with no random identifier or integrity...

  10. Critical (CVSS 9+) Published · updated

    CVE-2026-118177 Calendar discovery accepted local file and remote network share locations

    CriticalCVSS 9.1 EPSS 0.45%

    Exploit status: No public exploit known

    Affects: redhat/rhel10/thunderbird-flatpak, redhat/thunderbird, mozilla Thunderbird and 6 more

    When looking for calendars in a directory on a server, during account setup or when adding a new network calendar, Thunderbird accepted calendar locations pointing to other servers, local files or network shares. A malicious server, or a network attacker when the lookup used plai...

  11. Critical (CVSS 9+) Published · updated

    CVE-2026-118170 CVE-2026-118170

    CriticalCVSS 9.1 EPSS 0.29%

    Exploit status: No public exploit known

    Affects: Strapi Open Source and Enterprise Headless CMS

    The strapi/review-workflows package is vulnerable to a broken access control vulnerability allowing updates to be made without verifying whether the caller possesses update rights for the underlying document.

  12. Critical (CVSS 9+) Published · updated

    CVE-2026-118131 CVE-2026-118131

    CriticalCVSS 9.8 EPSS 0.43%

    Exploit status: No public exploit known

    Affects: azure linux gnupg2, GnuPG, ubuntu/gnupg2 and 1 more

    GnuPG (version 2.5.21) for Windows contains a vulnerability where default Discretionary Access Control List (DACL) inheritance on the C:\ProgramData directory allows members of the BUILTIN\Users group to create arbitrary subdirectories under this path. An attacker with low-privil...

  13. Critical (CVSS 9+) Published · updated

    CVE-2026-105780 Adobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863)

    CriticalCVSS 9.9 EPSS 0.49%

    Exploit status: No public exploit known

    Affects: Adobe Campaign Classic

    Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue...

  14. Critical (CVSS 9+) Published · updated

    CVE-2026-104353 Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)

    CriticalCVSS 9.9 EPSS 1.3%

    Exploit status: No public exploit known

    Affects: Adobe Campaign Classic

    Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this v...

  15. Critical (CVSS 9+) Published · updated

    CVE-2026-105489 Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)

    CriticalCVSS 9.9 EPSS 0.48%

    Exploit status: No public exploit known

    Affects: Adobe Campaign Classic

    Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnera...

  16. Critical (CVSS 9+) Published · updated

    CVE-2026-105779 Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)

    CriticalCVSS 9.1 EPSS 0.30%

    Exploit status: No public exploit known

    Affects: Adobe Campaign Classic

    Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measure...

  17. Critical (CVSS 9+) Published · updated

    CVE-2026-105781 Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)

    CriticalCVSS 10.0 EPSS 0.52%

    Exploit status: No public exploit known

    Affects: Adobe Campaign Classic

    Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to exec...

  18. Critical (CVSS 9+) Published · updated

    CVE-2026-104351 Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94)

    CriticalCVSS 9.9 EPSS 0.57%

    Exploit status: No public exploit known

    Affects: Adobe Campaign Classic

    Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary...

  19. Critical (CVSS 9+) Published · updated

    CVE-2026-104354 Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)

    CriticalCVSS 9.1 EPSS 0.50%

    Exploit status: No public exploit known

    Affects: Adobe Campaign Classic

    Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this...

  20. Critical (CVSS 9+) Published · updated

    CVE-2026-104350 Adobe Campaign Classic (ACC) | Cross-site Scripting (Reflected XSS) (CWE-79)

    CriticalCVSS 9.3 EPSS 0.61%

    Exploit status: No public exploit known

    Affects: Adobe Campaign Classic

    Adobe Campaign Classic (ACC) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploit...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS and public exploit-reference metadata. A proof-of-concept means public code exists; it is not evidence of exploitation. "Exploited in the wild" means confirmed exploitation (e.g. a CISA KEV listing).