Export limit exceeded: 17942 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (17942 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-103091 | 1 Google | 1 Sam | 2026-10-21 | N/A |
| Missing Authorization (CWE-862) and Initialization of a Resource with an Insecure Default (CWE-1188) in the MCP proxy (HandleStreamPassThrough in mcp_service.go) and OIDC registration flow (GET /info and POST /register in internal/controlplane/server.go) in Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.8 allow a remote attacker to self-enroll into the mesh and invoke arbitrary tools across all connected MCP backend nodes. Because GET /info publicly discloses OIDC configuration, POST /register auto-enrolls any valid OIDC token holder without claim filtering or ban checks, and the default policy binds sam:system:authenticated to wildcard services and targets, an attacker can obtain a mesh credential with full read, write, and execution access on backend services. Users should upgrade to version 0.1.0-alpha.9 or later, which enforces a fail-closed default policy, explicit policy-binding requirements on enrollment, and ban checks. | ||||
| CVE-2026-105772 | 1 Google | 1 Adk Typescript | 2026-10-21 | N/A |
| Path Traversal (CWE-22) in FileArtifactService in Google ADK TypeScript (@google/adk) versions 0.4.0 before 0.6.0 allows a remote unauthenticated attacker to read files matching the artifact directory layout or write files (when an agent tool invokes saveArtifact) outside the intended artifact storage root via crafted relative or percent-encoded path traversal sequences (such as ../ or ..%2F) in the userId or sessionId parameters when the ADK API server is exposed with the non-default FileArtifactService enabled. Applications using the default InMemoryArtifactService are unaffected. Upgrade to @google/adk version 0.6.0 or later. | ||||
| CVE-2026-113130 | 1 Google | 1 Chrome | 2026-10-21 | 8.8 High |
| Use after free in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-110917 | 1 Google | 1 Chrome | 2026-10-19 | 4.3 Medium |
| Memory corruption in SVG in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to read memory via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-110918 | 1 Google | 1 Chrome | 2026-10-19 | 4.3 Medium |
| Memory corruption in Core in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to read memory via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-110919 | 1 Google | 1 Chrome | 2026-10-19 | 8.8 High |
| Use after free in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-110920 | 1 Google | 1 Chrome | 2026-10-19 | 8.8 High |
| Memory corruption in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-110921 | 1 Google | 1 Chrome | 2026-10-19 | 8.8 High |
| Use after free in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-110922 | 1 Google | 1 Chrome | 2026-10-19 | 8.8 High |
| Use after free in Prerender in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical) | ||||
| CVE-2026-110913 | 1 Google | 1 Chrome | 2026-10-19 | 8.8 High |
| Memory corruption in DOM in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-110914 | 1 Google | 1 Chrome | 2026-10-19 | 8.8 High |
| Memory corruption in Workers in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-110915 | 1 Google | 1 Chrome | 2026-10-19 | 8.8 High |
| Use after free in Compositing in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-110916 | 1 Google | 1 Chrome | 2026-10-19 | 9.6 Critical |
| Improper input validation in Desktop in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-95702 | 1 Google | 1 Gvisor | 2026-10-15 | 7.8 High |
| Use-after-free vulnerability in VFS in Google gVisor prior to release 20260831.0 on all platforms allows a local attacker with standard container privileges to achieve code execution in the host sentry process by double-freeing the backing MemoryFile from an in-sandbox overlay filesystem. The sentry process remains confined by host-level Linux seccomp and namespace boundaries. | ||||
| CVE-2026-106396 | 1 Google | 2 Android, Chrome | 2026-10-15 | 5.4 Medium |
| Improper input validation in Omnibox in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-110150 | 2 Google, Microsoft | 2 Chrome, Windows | 2026-10-14 | 5.5 Medium |
| Privilege elevation in Installer in Google Chrome on on Windows prior to 155.0.8059.79 allowed a local attacker to obtain sensitive information via a local program. (Chromium security severity: High) | ||||
| CVE-2026-106340 | 2 Google, Microsoft | 2 Chrome, Windows | 2026-10-14 | 4.6 Medium |
| Missing authorization in CredentialProvider in Google Chrome on on Windows prior to 155.0.8059.39 allowed a local attacker to obtain sensitive information via physical access. (Chromium security severity: Low) | ||||
| CVE-2026-106341 | 1 Google | 1 Chrome | 2026-10-14 | 8.8 High |
| Type confusion in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-106342 | 1 Google | 1 Chrome | 2026-10-14 | 8.8 High |
| Information leak in Autofill in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-106343 | 1 Google | 2 Android, Chrome | 2026-10-14 | 5.4 Medium |
| Improper state validation in Autofill AI in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low) | ||||