Lỗ hổng mới
Lỗ hổng nghiêm trọng mới công bố (CVSS ≥ ngưỡng) hoặc đang bị khai thác thực tế (CISA KEV), gom từ NVD, GitHub Advisory, CVE.org, OSV và CISA KEV.
| ID | Tóm tắt | CVSS | Sản phẩm / package | Công bố | Nguồn |
|---|---|---|---|---|---|
| CVE-2026-117571 | WP Visitor Statistics (Real Time Traffic) < 8.8 - Unauthenticated Stored XSS via Tracker Device Parameters | 8.8 HIGH | Unknown WP Visitor Statistics (Real Time Traffic) | NVD, CVE.org | |
| CVE-2026-104368 Truy cập trái phép | Export and Import Users and Customers <= 2.7.5 - Authenticated (Subscriber+) Privilege Escalation via CSV Escape-Character Mismatch in Export/Import Round Trip via Biographical Info Field | 8.8 HIGH | webtoffee Export and Import Users and Customers | NVD, CVE.org | |
| CVE-2026-107249 | Block AJAX - Highly critical - PHP object injection - SA-CONTRIB-2026-192 | 9.8 CRITICAL | Drupal Block AJAX | NVD, CVE.org | |
| CVE-2026-119270 RCE | Improper input validation in CacheStorage in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromi... | 8.8 HIGH | Google Chrome | NVD, CVE.org | |
| CVE-2026-119271 RCE | Use after free in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | 8.8 HIGH | Google Chrome | NVD, CVE.org | |
| CVE-2026-119263 RCE | Memory corruption in GarbageCollection in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium... | 9.6 CRITICAL | Google Chrome | NVD, CVE.org | |
| CVE-2026-119264 RCE | Memory corruption in Dawn in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security seve... | 8.8 HIGH | Google Chrome | NVD, CVE.org | |
| CVE-2026-119265 RCE | Memory corruption in Quota in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security sev... | 8.8 HIGH | Google Chrome | NVD, CVE.org | |
| CVE-2026-119266 RCE | Use after free in Quota in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severi... | 8.8 HIGH | Google Chrome | NVD, CVE.org | |
| CVE-2026-119267 RCE | Memory corruption in DOM in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security sever... | 8.8 HIGH | Google Chrome | NVD, CVE.org | |
| CVE-2026-119268 RCE | Integer overflow in Editing in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security se... | 8.8 HIGH | Google Chrome | NVD, CVE.org | |
| CVE-2026-119269 RCE | Use after free in Blink in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | 8.8 HIGH | Google Chrome | NVD, CVE.org | |
| CVE-2026-119260 RCE | Use after free in Frames in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | 8.8 HIGH | Google Chrome | NVD, CVE.org | |
| CVE-2026-119261 RCE | Improper input validation in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium secu... | 9.6 CRITICAL | Google Chrome | NVD, CVE.org | |
| CVE-2026-119262 RCE | Improper input validation in V8 in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium securit... | 8.8 HIGH | Google Chrome | NVD, CVE.org | |
| CVE-2026-76028 RCE | Use after free in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | 8.8 HIGH | Google Chrome | NVD, CVE.org | |
| CVE-2026-76029 RCE | Memory corruption in Network in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security s... | 8.8 HIGH | Google Chrome | NVD, CVE.org | |
| CVE-2026-76030 RCE | Memory corruption in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium securit... | 8.8 HIGH | Google Chrome | NVD, CVE.org | |
| CVE-2026-76031 RCE | Use after free in Input in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | 8.8 HIGH | Google Chrome | NVD, CVE.org | |
| CVE-2026-76025 RCE | Use after free in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | 8.8 HIGH | Google Chrome | NVD, CVE.org | |
| CVE-2026-76026 RCE | Memory corruption in Autofill in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | 8.8 HIGH | Google Chrome | NVD, CVE.org | |
| CVE-2026-92744 RCE Truy cập trái phép | Delinea Privilege Manager agent unauthenticated remote code execution vulnerability | 8.7 HIGH | Delinea Privilege Manager | NVD, CVE.org | |
| CVE-2023-22793 RCE | A vulnerability allowing an unauthenticated attacker to perform remote code execution (RCE) on servers running the Veeam Virtualization Extensions service of Veeam Management Pack for Microsoft Sys... | 9.3 CRITICAL | Veeam Management Pack for Microsoft System Center | NVD, CVE.org | |
| CVE-2026-107238 RCE | A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) as the LocalSystem account on servers running the Veeam Management Pack for Microsoft System Center Coll... | 8.7 HIGH | Veeam Management Pack for Microsoft System Center | NVD, CVE.org | |
| CVE-2026-107239 RCE Lộ dữ liệu | A vulnerability allowing a member of the Veeam Virtualization Extensions Users group to perform remote code execution (RCE) on servers running the Veeam Management Pack for Microsoft System Center ... | 8.8 HIGH | Veeam Management Pack for Microsoft System Center | NVD, CVE.org | |
| CVE-2026-61719 | WeGIA: Stored Cross-Site Scripting (XSS) in "historico_prontuarios.php" via "textoProntuario" Field | 8.9 HIGH | LabRedesCefetRJ WeGIA | NVD, CVE.org | |
| CVE-2026-61707 RCE Truy cập trái phép | SOCFortress CoPilot: Stored case-report template injection permits backend code execution | 9.0 CRITICAL | socfortress CoPilot | NVD, CVE.org | |
| CVE-2026-61671 Truy cập trái phép | WeGIA: Systemic IDOR + Missing CSRF — extract($_REQUEST) in All Controle Classes | 8.1 HIGH | LabRedesCefetRJ WeGIA | NVD, CVE.org | |
| CVE-2026-61654 Lộ dữ liệu | Lightdash: Unauthenticated dbt Cloud webhook with path injection leaks API key | 8.3 HIGH | lightdash lightdash | NVD, CVE.org | |
| CVE-2026-61645 RCE Lộ dữ liệu | Docat has Arbitrary File Upload exists in Upload API | 9.1 CRITICAL | docat-org docat | NVD, CVE.org | |
| CVE-2026-45049 | OpenAM Session Hijacking via CDSSO | 8.3 HIGH | OpenIdentityPlatform OpenAM | NVD, CVE.org | |
| CVE-2026-13303 Lộ dữ liệu | Boundary vulnerable to server-side request forgery in Vault credential store | 8.7 HIGH | HashiCorp Boundary, HashiCorp Boundary Enterprise | NVD, CVE.org | |
| CVE-2026-61576 Lộ dữ liệu | Lightdash: Unauthenticated dbt Cloud webhook with path injection leaks API key | 8.3 HIGH | lightdash lightdash | NVD, CVE.org | |
| CVE-2026-103093 RCE Truy cập trái phép | Sandbox Escape via Table Rotation in ServiceNow AI Platform | 9.4 CRITICAL | ServiceNow ServiceNow AI Platform | NVD, CVE.org | |
| CVE-2026-9535 | A out-of-bounds read vulnerability exists in the vtkChacoReader InputGraph2 functionality of vtk (version(s): 9.6.1). A specially crafted chaco can lead to an out-of-bounds read. An attacker can pr... | 8.2 HIGH | vtk vtk | NVD, CVE.org | |
| CVE-2026-119168 Truy cập trái phép | Nomad allocation data migration may allow host directory permission modification via symlink following | 8.8 HIGH | HashiCorp Nomad, HashiCorp Nomad Enterprise | NVD, CVE.org | |
| CVE-2026-107347 | Nomad dispatch payload writes can escape the allocation directory through symlinks | 8.4 HIGH | HashiCorp Nomad, HashiCorp Nomad Enterprise | NVD, CVE.org | |
| CVE-2026-118769 RCE | Botan: Integer overflow when reporting block size in FFI can cause memory corruption | 9.2 CRITICAL | randombit botan | NVD, CVE.org | |
| CVE-2026-118762 | Monkeytype: fork PR can execute code with elevated GITHUB_TOKEN | 9.3 CRITICAL | monkeytypegame monkeytype | NVD, CVE.org | |
| CVE-2023-7357 RCE | FlexNet Publisher lmadmin Rogue Vendor Daemon Vulnerability | 8.6 HIGH | Revera FlexNet Publisher | NVD, CVE.org | |
| CVE-2026-9800 | Keycloak vulnerable to authorization bypass via incorrect uri comparison | 8.1 HIGH | maven/org.keycloak:keycloak-services, maven/org.keycloak:keycloak-policy-enforcer | GitHub Advisory, OSV.dev | |
| CVE-2026-119115 Truy cập trái phép | Incorrect authorization in issuer resolution in AWS Private CA Connector for Kubernetes | 8.5 HIGH | AWS aws-privateca-issuer | NVD, CVE.org | |
| GHSA-w9x9-j56r-h98r Truy cập trái phép | @eeacms/volto-chatbot has Unauthenticated Danswer API Confused Deputy Proxy | 8.2 HIGH | npm/@eeacms/volto-chatbot | GitHub Advisory, OSV.dev | |
| CVE-2026-62160 | Daptin: ParseAcceptLanguage _ separator bypass enables >250x CPU amplification via Accept-Language header in LanguageMiddleware | 8.7 HIGH | go/github.com/daptin/daptin, daptin daptin | GitHub Advisory, NVD, CVE.org, OSV.dev | |
| CVE-2026-119145 RCE Lộ dữ liệu | Frappe before 15.121.0 and 16.x before 16.34.0 Path Traversal RCE via File Upload | 9.9 CRITICAL | frappe frappe | NVD, CVE.org | |
| CVE-2026-119144 RCE | Frappe Framework before 15.111.0 and 16.x before 16.21.0 Server-Side Template Injection via Message Fields | 8.8 HIGH | frappe frappe | NVD, CVE.org | |
| CVE-2026-119129 Truy cập trái phép | ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.19.5 Account Takeover via Device Authorization Approval | 8.1 HIGH | zitadel zitadel | NVD, CVE.org | |
| CVE-2026-119127 Truy cập trái phép | ZITADEL 4.0.0 before 4.19.5 Account Takeover via Login V2 Host Header Injection | 8.1 HIGH | zitadel zitadel | NVD, CVE.org | |
| CVE-2026-90868 RCE | OS Command Injection in Progress WS_FTP Server | 9.9 CRITICAL | Progress Software WS_FTP Server | NVD, CVE.org | |
| CVE-2026-90867 Truy cập trái phép | Improper Access Control of Web Admin Console in Progress WS_FTP Server | 8.1 HIGH | Progress Software WS_FTP Server | NVD, CVE.org |