CVE sync 2026-11-11T23:28:28Z
This commit is contained in:
Vulnerability Bot
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "redhat",
|
||||
"dateReserved": "2025-10-07T03:14:35.482Z",
|
||||
"datePublished": "2026-09-15T22:59:03.366Z",
|
||||
"dateUpdated": "2026-11-05T14:47:36.610Z"
|
||||
"dateUpdated": "2026-11-11T22:54:47.290Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -192,12 +192,30 @@
|
||||
"cpe:/a:redhat:enterprise_linux:9::appstream"
|
||||
]
|
||||
},
|
||||
{
|
||||
"vendor": "Red Hat",
|
||||
"product": "Red Hat Enterprise Linux 9.8 Extended Update Support",
|
||||
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
||||
"packageName": "podman",
|
||||
"defaultStatus": "affected",
|
||||
"versions": [
|
||||
{
|
||||
"version": "6:5.8.2-10.el9_8",
|
||||
"lessThan": "*",
|
||||
"versionType": "rpm",
|
||||
"status": "unaffected"
|
||||
}
|
||||
],
|
||||
"cpes": [
|
||||
"cpe:/a:redhat:rhel_eus:9.8::appstream"
|
||||
]
|
||||
},
|
||||
{
|
||||
"vendor": "Red Hat",
|
||||
"product": "Red Hat Enterprise Linux 8",
|
||||
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
||||
"packageName": "buildah",
|
||||
"defaultStatus": "affected",
|
||||
"defaultStatus": "unaffected",
|
||||
"cpes": [
|
||||
"cpe:/a:redhat:enterprise_linux:8"
|
||||
]
|
||||
@@ -267,7 +285,7 @@
|
||||
"product": "Red Hat OpenShift Container Platform 4",
|
||||
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
||||
"packageName": "skopeo",
|
||||
"defaultStatus": "affected",
|
||||
"defaultStatus": "unaffected",
|
||||
"cpes": [
|
||||
"cpe:/a:redhat:openshift:4"
|
||||
]
|
||||
@@ -358,6 +376,14 @@
|
||||
"x_refsource_REDHAT"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://access.redhat.com/errata/RHSA-2026:99093",
|
||||
"name": "RHSA-2026:99093",
|
||||
"tags": [
|
||||
"vendor-advisory",
|
||||
"x_refsource_REDHAT"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://access.redhat.com/security/cve/CVE-2025-11395",
|
||||
"tags": [
|
||||
@@ -415,7 +441,7 @@
|
||||
"providerMetadata": {
|
||||
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
|
||||
"shortName": "redhat",
|
||||
"dateUpdated": "2026-11-05T14:47:36.610Z"
|
||||
"dateUpdated": "2026-11-11T22:54:47.290Z"
|
||||
},
|
||||
"x_generator": {
|
||||
"engine": "cvelib 1.8.0"
|
||||
|
||||
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "redhat",
|
||||
"dateReserved": "2026-10-09T13:14:56.844Z",
|
||||
"datePublished": "2026-10-12T14:43:09.674Z",
|
||||
"dateUpdated": "2026-11-06T08:15:58.976Z"
|
||||
"dateUpdated": "2026-11-11T22:35:16.667Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -54,8 +54,16 @@
|
||||
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
||||
"packageName": "mutter",
|
||||
"defaultStatus": "affected",
|
||||
"versions": [
|
||||
{
|
||||
"version": "0:49.4-6.el10_3.1",
|
||||
"lessThan": "*",
|
||||
"versionType": "rpm",
|
||||
"status": "unaffected"
|
||||
}
|
||||
],
|
||||
"cpes": [
|
||||
"cpe:/a:redhat:enterprise_linux:10"
|
||||
"cpe:/o:redhat:enterprise_linux:10.3"
|
||||
]
|
||||
},
|
||||
{
|
||||
@@ -90,6 +98,14 @@
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://access.redhat.com/errata/RHSA-2026:99130",
|
||||
"name": "RHSA-2026:99130",
|
||||
"tags": [
|
||||
"vendor-advisory",
|
||||
"x_refsource_REDHAT"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://access.redhat.com/security/cve/CVE-2026-108094",
|
||||
"tags": [
|
||||
@@ -147,7 +163,7 @@
|
||||
"providerMetadata": {
|
||||
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
|
||||
"shortName": "redhat",
|
||||
"dateUpdated": "2026-11-06T08:15:58.976Z"
|
||||
"dateUpdated": "2026-11-11T22:35:16.667Z"
|
||||
},
|
||||
"x_generator": {
|
||||
"engine": "cvelib 1.8.0"
|
||||
|
||||
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "redhat",
|
||||
"dateReserved": "2026-10-30T16:19:44.205Z",
|
||||
"datePublished": "2026-10-30T17:59:41.041Z",
|
||||
"dateUpdated": "2026-11-11T13:51:31.269Z"
|
||||
"dateUpdated": "2026-11-11T22:35:11.648Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -66,6 +66,24 @@
|
||||
"cpe:/o:redhat:enterprise_linux:10.3"
|
||||
]
|
||||
},
|
||||
{
|
||||
"vendor": "Red Hat",
|
||||
"product": "Red Hat Enterprise Linux 10.2 Extended Update Support",
|
||||
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
||||
"packageName": "gstreamer1-plugins-bad-free",
|
||||
"defaultStatus": "affected",
|
||||
"versions": [
|
||||
{
|
||||
"version": "0:1.26.7-2.el10_2.8",
|
||||
"lessThan": "*",
|
||||
"versionType": "rpm",
|
||||
"status": "unaffected"
|
||||
}
|
||||
],
|
||||
"cpes": [
|
||||
"cpe:/o:redhat:enterprise_linux_eus:10.2"
|
||||
]
|
||||
},
|
||||
{
|
||||
"vendor": "Red Hat",
|
||||
"product": "Red Hat Enterprise Linux 7",
|
||||
@@ -106,6 +124,14 @@
|
||||
"x_refsource_REDHAT"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://access.redhat.com/errata/RHSA-2026:99118",
|
||||
"name": "RHSA-2026:99118",
|
||||
"tags": [
|
||||
"vendor-advisory",
|
||||
"x_refsource_REDHAT"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://access.redhat.com/security/cve/CVE-2026-119777",
|
||||
"tags": [
|
||||
@@ -160,7 +186,7 @@
|
||||
"providerMetadata": {
|
||||
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
|
||||
"shortName": "redhat",
|
||||
"dateUpdated": "2026-11-11T13:51:31.269Z"
|
||||
"dateUpdated": "2026-11-11T22:35:11.648Z"
|
||||
},
|
||||
"x_generator": {
|
||||
"engine": "cvelib 1.8.0"
|
||||
|
||||
@@ -0,0 +1,130 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-125637",
|
||||
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "redhat",
|
||||
"dateReserved": "2026-11-10T04:57:41.730Z",
|
||||
"datePublished": "2026-11-11T22:35:12.202Z",
|
||||
"dateUpdated": "2026-11-11T22:35:12.202Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"title": "Konflux-ci: unvalidated hostname fields enable caddyfile config injection in the konflux ui proxy generator, allowing an unauthenticated route to be spliced ahead of the forward_auth/impersonate authorization chain",
|
||||
"metrics": [
|
||||
{
|
||||
"other": {
|
||||
"content": {
|
||||
"value": "Important",
|
||||
"namespace": "https://access.redhat.com/security/updates/classification/"
|
||||
},
|
||||
"type": "Red Hat severity rating"
|
||||
}
|
||||
},
|
||||
{
|
||||
"cvssV3_1": {
|
||||
"attackComplexity": "LOW",
|
||||
"attackVector": "NETWORK",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 7.2,
|
||||
"baseSeverity": "HIGH",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"privilegesRequired": "HIGH",
|
||||
"scope": "UNCHANGED",
|
||||
"userInteraction": "NONE",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
||||
"version": "3.1"
|
||||
},
|
||||
"format": "CVSS"
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "A flaw was found in the Konflux UI proxy. Hostname values defined in the KonfluxUI custom resource are inserted directly into proxy configuration files without adequate validation or sanitization. An authenticated user with permissions to modify the custom resource can inject malicious configuration directives to bypass authentication and authorization controls, potentially exposing internal backend services. In addition, providing malformed input can cause the configuration generator to fail, resulting in a denial of service (DoS) by preventing the proxy from starting."
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"versions": [
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "0",
|
||||
"versionType": "semver",
|
||||
"lessThanOrEqual": "0.2.2"
|
||||
}
|
||||
],
|
||||
"packageName": "konflux-ci",
|
||||
"collectionURL": "https://github.com/konflux-ci/konflux-ci",
|
||||
"defaultStatus": "unaffected"
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://access.redhat.com/security/cve/CVE-2026-125637",
|
||||
"tags": [
|
||||
"vdb-entry",
|
||||
"x_refsource_REDHAT"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2569294",
|
||||
"name": "RHBZ#2569294",
|
||||
"tags": [
|
||||
"issue-tracking",
|
||||
"x_refsource_REDHAT"
|
||||
]
|
||||
}
|
||||
],
|
||||
"datePublic": "2026-11-10T00:00:00.000Z",
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"cweId": "CWE-94",
|
||||
"description": "Improper Control of Generation of Code",
|
||||
"lang": "en",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"x_redhatCweChain": "CWE-94: Improper Control of Generation of Code",
|
||||
"workarounds": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
|
||||
}
|
||||
],
|
||||
"timeline": [
|
||||
{
|
||||
"lang": "en",
|
||||
"time": "2026-11-10T04:55:44.490Z",
|
||||
"value": "Reported to Red Hat."
|
||||
},
|
||||
{
|
||||
"lang": "en",
|
||||
"time": "2026-11-10T00:00:00.000Z",
|
||||
"value": "Made public."
|
||||
}
|
||||
],
|
||||
"credits": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Red Hat would like to thank abhi04anon - (GitHub) for reporting this issue."
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
|
||||
"shortName": "redhat",
|
||||
"dateUpdated": "2026-11-11T22:35:12.202Z"
|
||||
},
|
||||
"x_generator": {
|
||||
"engine": "cvelib 1.8.0"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "redhat",
|
||||
"dateReserved": "2026-11-10T10:37:49.396Z",
|
||||
"datePublished": "2026-11-10T11:22:59.567Z",
|
||||
"dateUpdated": "2026-11-11T18:35:56.566Z"
|
||||
"dateUpdated": "2026-11-11T22:34:35.277Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -66,6 +66,24 @@
|
||||
"cpe:/a:redhat:enterprise_linux:8::appstream"
|
||||
]
|
||||
},
|
||||
{
|
||||
"vendor": "Red Hat",
|
||||
"product": "Red Hat Enterprise Linux 9",
|
||||
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
||||
"packageName": "gstreamer1-plugins-base",
|
||||
"defaultStatus": "affected",
|
||||
"versions": [
|
||||
{
|
||||
"version": "0:1.22.12-10.el9_9.1",
|
||||
"lessThan": "*",
|
||||
"versionType": "rpm",
|
||||
"status": "unaffected"
|
||||
}
|
||||
],
|
||||
"cpes": [
|
||||
"cpe:/a:redhat:enterprise_linux:9::appstream"
|
||||
]
|
||||
},
|
||||
{
|
||||
"vendor": "Red Hat",
|
||||
"product": "Red Hat Enterprise Linux 10",
|
||||
@@ -105,16 +123,6 @@
|
||||
"cpes": [
|
||||
"cpe:/o:redhat:rhel_els:7"
|
||||
]
|
||||
},
|
||||
{
|
||||
"vendor": "Red Hat",
|
||||
"product": "Red Hat Enterprise Linux 9",
|
||||
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
||||
"packageName": "gstreamer1-plugins-base",
|
||||
"defaultStatus": "affected",
|
||||
"cpes": [
|
||||
"cpe:/a:redhat:enterprise_linux:9"
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
@@ -126,6 +134,14 @@
|
||||
"x_refsource_REDHAT"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://access.redhat.com/errata/RHSA-2026:99126",
|
||||
"name": "RHSA-2026:99126",
|
||||
"tags": [
|
||||
"vendor-advisory",
|
||||
"x_refsource_REDHAT"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://access.redhat.com/security/cve/CVE-2026-125712",
|
||||
"tags": [
|
||||
@@ -180,7 +196,7 @@
|
||||
"providerMetadata": {
|
||||
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
|
||||
"shortName": "redhat",
|
||||
"dateUpdated": "2026-11-11T18:35:56.566Z"
|
||||
"dateUpdated": "2026-11-11T22:34:35.277Z"
|
||||
},
|
||||
"x_generator": {
|
||||
"engine": "cvelib 1.8.0"
|
||||
|
||||
@@ -0,0 +1,170 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126757",
|
||||
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "VulDB",
|
||||
"dateReserved": "2026-11-11T16:58:28.007Z",
|
||||
"datePublished": "2026-11-11T22:45:40.168Z",
|
||||
"dateUpdated": "2026-11-11T22:45:40.168Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"providerMetadata": {
|
||||
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
|
||||
"shortName": "VulDB",
|
||||
"dateUpdated": "2026-11-11T22:45:40.168Z"
|
||||
},
|
||||
"title": "Moonshot AI Kimi Code Web UI index-HU0LCM-X.js isOriginAllowed redirect",
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"type": "CWE",
|
||||
"cweId": "CWE-601",
|
||||
"lang": "en",
|
||||
"description": "Open Redirect"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Moonshot AI",
|
||||
"product": "Kimi Code",
|
||||
"versions": [
|
||||
{
|
||||
"version": "2.5.0",
|
||||
"status": "affected"
|
||||
},
|
||||
{
|
||||
"version": "2.5.1",
|
||||
"status": "affected"
|
||||
},
|
||||
{
|
||||
"version": "2.5.2",
|
||||
"status": "affected"
|
||||
}
|
||||
],
|
||||
"cpes": [
|
||||
"cpe:2.3:a:moonshot_ai:kimi_code:*:*:*:*:*:*:*:*"
|
||||
],
|
||||
"modules": [
|
||||
"Web UI"
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "A security vulnerability has been detected in Moonshot AI Kimi Code up to 2.5.2. This affects the function isOriginAllowed of the file apps/kimi-code/dist-web/assets/index-HU0LCM-X.js of the component Web UI. Such manipulation of the argument kimi_origin leads to open redirect. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"cvssV4_0": {
|
||||
"version": "4.0",
|
||||
"baseScore": 5.3,
|
||||
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
|
||||
"baseSeverity": "MEDIUM"
|
||||
}
|
||||
},
|
||||
{
|
||||
"cvssV3_1": {
|
||||
"version": "3.1",
|
||||
"baseScore": 4.3,
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C",
|
||||
"baseSeverity": "MEDIUM"
|
||||
}
|
||||
},
|
||||
{
|
||||
"cvssV3_0": {
|
||||
"version": "3.0",
|
||||
"baseScore": 4.3,
|
||||
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C",
|
||||
"baseSeverity": "MEDIUM"
|
||||
}
|
||||
},
|
||||
{
|
||||
"cvssV2_0": {
|
||||
"version": "2.0",
|
||||
"baseScore": 5,
|
||||
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:C"
|
||||
}
|
||||
}
|
||||
],
|
||||
"timeline": [
|
||||
{
|
||||
"time": "2026-11-11T00:00:00.000Z",
|
||||
"lang": "en",
|
||||
"value": "Advisory disclosed"
|
||||
},
|
||||
{
|
||||
"time": "2026-11-11T01:00:00.000Z",
|
||||
"lang": "en",
|
||||
"value": "VulDB entry created"
|
||||
},
|
||||
{
|
||||
"time": "2026-11-11T18:03:39.000Z",
|
||||
"lang": "en",
|
||||
"value": "VulDB entry last update"
|
||||
}
|
||||
],
|
||||
"credits": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "ShiyuFan_BinYuan (VulDB User)",
|
||||
"type": "reporter"
|
||||
},
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "VulDB CNA Team",
|
||||
"type": "coordinator"
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://vuldb.com/vuln/435867",
|
||||
"name": "VDB-435867 | Moonshot AI Kimi Code Web UI index-HU0LCM-X.js isOriginAllowed redirect",
|
||||
"tags": [
|
||||
"vdb-entry",
|
||||
"technical-description"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://vuldb.com/vuln/435867/cti",
|
||||
"name": "VDB-435867 | CTI Indicators (IOB, IOC, TTP, IOA)",
|
||||
"tags": [
|
||||
"signature",
|
||||
"permissions-required"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://vuldb.com/cve/CVE-2026-126757",
|
||||
"name": "CVE-2026-126757 | CVE Analysis and Report",
|
||||
"tags": [
|
||||
"third-party-advisory"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://vuldb.com/submit/1033259",
|
||||
"name": "Submit #1033259 | 北京月之暗面科技股份有限公司 kimi code 0.42.0 Kimi Code 默认配置RCE 无需开启危险模式",
|
||||
"tags": [
|
||||
"third-party-advisory"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://mcniyfj5bw9b.feishu.cn/docx/IZ43dY0wzoDtnUxGgy7cQ6xcnFh",
|
||||
"tags": [
|
||||
"exploit"
|
||||
]
|
||||
}
|
||||
],
|
||||
"x_generator": [
|
||||
"VulDB PVTS v202611"
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,185 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126758",
|
||||
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "VulDB",
|
||||
"dateReserved": "2026-11-11T16:58:32.820Z",
|
||||
"datePublished": "2026-11-11T23:00:47.831Z",
|
||||
"dateUpdated": "2026-11-11T23:00:47.831Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"providerMetadata": {
|
||||
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
|
||||
"shortName": "VulDB",
|
||||
"dateUpdated": "2026-11-11T23:00:47.831Z"
|
||||
},
|
||||
"title": "Moonshot AI Kimi Code WorkspaceDirsService local.toml reliance on untrusted inputs in a security decision",
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"type": "CWE",
|
||||
"cweId": "CWE-807",
|
||||
"lang": "en",
|
||||
"description": "Reliance on Untrusted Inputs in a Security Decision"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"type": "CWE",
|
||||
"cweId": "CWE-20",
|
||||
"lang": "en",
|
||||
"description": "Improper Input Validation"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Moonshot AI",
|
||||
"product": "Kimi Code",
|
||||
"versions": [
|
||||
{
|
||||
"version": "2.0.0",
|
||||
"status": "affected"
|
||||
},
|
||||
{
|
||||
"version": "2.0.1",
|
||||
"status": "affected"
|
||||
},
|
||||
{
|
||||
"version": "2.0.2",
|
||||
"status": "affected"
|
||||
},
|
||||
{
|
||||
"version": "2.1.0",
|
||||
"status": "unaffected"
|
||||
}
|
||||
],
|
||||
"cpes": [
|
||||
"cpe:2.3:a:moonshot_ai:kimi_code:*:*:*:*:*:*:*:*"
|
||||
],
|
||||
"modules": [
|
||||
"WorkspaceDirsService"
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "A vulnerability was detected in Moonshot AI Kimi Code up to 2.0.2. This vulnerability affects unknown code of the file .kimi-code/local.toml of the component WorkspaceDirsService. Performing a manipulation of the argument additional_dir results in reliance on untrusted inputs in a security decision. The attack requires a local approach. The exploit is now public and may be used. Upgrading to version 2.1.0 is able to resolve this issue. Upgrading the affected component is recommended."
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"cvssV4_0": {
|
||||
"version": "4.0",
|
||||
"baseScore": 4.8,
|
||||
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
|
||||
"baseSeverity": "MEDIUM"
|
||||
}
|
||||
},
|
||||
{
|
||||
"cvssV3_1": {
|
||||
"version": "3.1",
|
||||
"baseScore": 4.4,
|
||||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:O/RC:C",
|
||||
"baseSeverity": "MEDIUM"
|
||||
}
|
||||
},
|
||||
{
|
||||
"cvssV3_0": {
|
||||
"version": "3.0",
|
||||
"baseScore": 4.4,
|
||||
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:O/RC:C",
|
||||
"baseSeverity": "MEDIUM"
|
||||
}
|
||||
},
|
||||
{
|
||||
"cvssV2_0": {
|
||||
"version": "2.0",
|
||||
"baseScore": 3.2,
|
||||
"vectorString": "AV:L/AC:L/Au:S/C:N/I:P/A:P/E:POC/RL:OF/RC:C"
|
||||
}
|
||||
}
|
||||
],
|
||||
"timeline": [
|
||||
{
|
||||
"time": "2026-11-11T00:00:00.000Z",
|
||||
"lang": "en",
|
||||
"value": "Advisory disclosed"
|
||||
},
|
||||
{
|
||||
"time": "2026-11-11T01:00:00.000Z",
|
||||
"lang": "en",
|
||||
"value": "VulDB entry created"
|
||||
},
|
||||
{
|
||||
"time": "2026-11-11T18:03:43.000Z",
|
||||
"lang": "en",
|
||||
"value": "VulDB entry last update"
|
||||
}
|
||||
],
|
||||
"credits": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "ShiyuFan_BinYuan (VulDB User)",
|
||||
"type": "reporter"
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://vuldb.com/vuln/435868",
|
||||
"name": "VDB-435868 | Moonshot AI Kimi Code WorkspaceDirsService local.toml reliance on untrusted inputs in a security decision",
|
||||
"tags": [
|
||||
"vdb-entry",
|
||||
"technical-description"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://vuldb.com/vuln/435868/cti",
|
||||
"name": "VDB-435868 | CTI Indicators (IOB, IOC, IOA)",
|
||||
"tags": [
|
||||
"signature",
|
||||
"permissions-required"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://vuldb.com/cve/CVE-2026-126758",
|
||||
"name": "CVE-2026-126758 | CVE Analysis and Report",
|
||||
"tags": [
|
||||
"third-party-advisory"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://vuldb.com/submit/1033260",
|
||||
"name": "Submit #1033260 | 北京月之暗面科技股份有限公司 kimi code 0.42.0 Kimi Code 审批绕过",
|
||||
"tags": [
|
||||
"third-party-advisory"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://mcniyfj5bw9b.feishu.cn/docx/LsJldjpjXomkb4xTJ6CcWzdFnvd",
|
||||
"tags": [
|
||||
"exploit"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/MoonshotAI/kimi-code/releases/tag/%40moonshot-ai%2Fkimi-code%402.1.0",
|
||||
"tags": [
|
||||
"patch"
|
||||
]
|
||||
}
|
||||
],
|
||||
"x_generator": [
|
||||
"VulDB PVTS v202611"
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,165 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126759",
|
||||
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "VulDB",
|
||||
"dateReserved": "2026-11-11T17:01:35.277Z",
|
||||
"datePublished": "2026-11-11T23:15:22.210Z",
|
||||
"dateUpdated": "2026-11-11T23:15:22.210Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"providerMetadata": {
|
||||
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
|
||||
"shortName": "VulDB",
|
||||
"dateUpdated": "2026-11-11T23:15:22.210Z"
|
||||
},
|
||||
"title": "H3C ICG2000 Unified Communication Gateway Web Management check.j missing authentication",
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"type": "CWE",
|
||||
"cweId": "CWE-306",
|
||||
"lang": "en",
|
||||
"description": "Missing Authentication"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"type": "CWE",
|
||||
"cweId": "CWE-287",
|
||||
"lang": "en",
|
||||
"description": "Improper Authentication"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "H3C",
|
||||
"product": "ICG2000 Unified Communication Gateway",
|
||||
"versions": [
|
||||
{
|
||||
"version": "2023",
|
||||
"status": "affected"
|
||||
}
|
||||
],
|
||||
"cpes": [
|
||||
"cpe:2.3:h:h3c:icg2000_unified_communication_gateway:*:*:*:*:*:*:*:*"
|
||||
],
|
||||
"modules": [
|
||||
"Web Management Module"
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "A flaw has been found in H3C ICG2000 Unified Communication Gateway 2023. This issue affects some unknown processing of the file /wnm/check.j of the component Web Management Module. Executing a manipulation can lead to missing authentication. The attack may be performed from remote. The exploit has been published and may be used. The researcher claims that the vendor has acknowledged receipt of the vulnerability report. No further response has been received."
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"cvssV4_0": {
|
||||
"version": "4.0",
|
||||
"baseScore": 6.9,
|
||||
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
|
||||
"baseSeverity": "MEDIUM"
|
||||
}
|
||||
},
|
||||
{
|
||||
"cvssV3_1": {
|
||||
"version": "3.1",
|
||||
"baseScore": 5.3,
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
|
||||
"baseSeverity": "MEDIUM"
|
||||
}
|
||||
},
|
||||
{
|
||||
"cvssV3_0": {
|
||||
"version": "3.0",
|
||||
"baseScore": 5.3,
|
||||
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
|
||||
"baseSeverity": "MEDIUM"
|
||||
}
|
||||
},
|
||||
{
|
||||
"cvssV2_0": {
|
||||
"version": "2.0",
|
||||
"baseScore": 5,
|
||||
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:UR"
|
||||
}
|
||||
}
|
||||
],
|
||||
"timeline": [
|
||||
{
|
||||
"time": "2026-11-11T00:00:00.000Z",
|
||||
"lang": "en",
|
||||
"value": "Advisory disclosed"
|
||||
},
|
||||
{
|
||||
"time": "2026-11-11T01:00:00.000Z",
|
||||
"lang": "en",
|
||||
"value": "VulDB entry created"
|
||||
},
|
||||
{
|
||||
"time": "2026-11-11T18:06:40.000Z",
|
||||
"lang": "en",
|
||||
"value": "VulDB entry last update"
|
||||
}
|
||||
],
|
||||
"credits": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "bruce_xiaowei (VulDB User)",
|
||||
"type": "reporter"
|
||||
},
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "VulDB CNA Team",
|
||||
"type": "coordinator"
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://vuldb.com/vuln/435869",
|
||||
"name": "VDB-435869 | H3C ICG2000 Unified Communication Gateway Web Management check.j missing authentication",
|
||||
"tags": [
|
||||
"vdb-entry"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://vuldb.com/vuln/435869/cti",
|
||||
"name": "VDB-435869 | CTI Indicators (IOB, IOC, IOA)",
|
||||
"tags": [
|
||||
"signature",
|
||||
"permissions-required"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://vuldb.com/cve/CVE-2026-126759",
|
||||
"name": "CVE-2026-126759 | CVE Analysis and Report",
|
||||
"tags": [
|
||||
"third-party-advisory"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://vuldb.com/submit/1035822",
|
||||
"name": "Submit #1035822 | H3C (New H3C Technologies Co., Ltd.) `ICG2000 Unified Communication Gateway (ICG 2000 Information Communication Gateway), web management module ICG2000, firmware generation 2023 (device self-reports cyear=2023; exact Comware release not yet determined) Au",
|
||||
"tags": [
|
||||
"third-party-advisory"
|
||||
]
|
||||
}
|
||||
],
|
||||
"x_generator": [
|
||||
"VulDB PVTS v202611"
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126840",
|
||||
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Chrome",
|
||||
"dateReserved": "2026-11-11T22:07:48.449Z",
|
||||
"datePublished": "2026-11-11T22:39:02.034Z",
|
||||
"dateUpdated": "2026-11-11T22:39:02.034Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Google",
|
||||
"product": "Chrome",
|
||||
"versions": [
|
||||
{
|
||||
"version": "157.0.8103.78",
|
||||
"status": "affected",
|
||||
"lessThan": "157.0.8103.78",
|
||||
"versionType": "custom"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Out of bounds write in Network in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Out of bounds write",
|
||||
"cweId": "CWE-787"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"shortName": "Chrome",
|
||||
"dateUpdated": "2026-11-11T22:39:02.034Z"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"
|
||||
},
|
||||
{
|
||||
"url": "https://issues.chromium.org/issues/578664961"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126841",
|
||||
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Chrome",
|
||||
"dateReserved": "2026-11-11T22:07:50.164Z",
|
||||
"datePublished": "2026-11-11T22:39:05.128Z",
|
||||
"dateUpdated": "2026-11-11T22:39:05.128Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Google",
|
||||
"product": "Chrome",
|
||||
"versions": [
|
||||
{
|
||||
"version": "157.0.8103.78",
|
||||
"status": "affected",
|
||||
"lessThan": "157.0.8103.78",
|
||||
"versionType": "custom"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Out of bounds read in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)"
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Out of bounds read",
|
||||
"cweId": "CWE-125"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"shortName": "Chrome",
|
||||
"dateUpdated": "2026-11-11T22:39:05.128Z"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"
|
||||
},
|
||||
{
|
||||
"url": "https://issues.chromium.org/issues/580865537"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126842",
|
||||
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Chrome",
|
||||
"dateReserved": "2026-11-11T22:07:51.771Z",
|
||||
"datePublished": "2026-11-11T22:38:52.967Z",
|
||||
"dateUpdated": "2026-11-11T22:38:52.967Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Google",
|
||||
"product": "Chrome",
|
||||
"versions": [
|
||||
{
|
||||
"version": "157.0.8103.78",
|
||||
"status": "affected",
|
||||
"lessThan": "157.0.8103.78",
|
||||
"versionType": "custom"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Use after free in ANGLE in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Use after free",
|
||||
"cweId": "CWE-416"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"shortName": "Chrome",
|
||||
"dateUpdated": "2026-11-11T22:38:52.967Z"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"
|
||||
},
|
||||
{
|
||||
"url": "https://issues.chromium.org/issues/574209539"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126843",
|
||||
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Chrome",
|
||||
"dateReserved": "2026-11-11T22:07:53.818Z",
|
||||
"datePublished": "2026-11-11T22:39:00.467Z",
|
||||
"dateUpdated": "2026-11-11T22:39:00.467Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Google",
|
||||
"product": "Chrome",
|
||||
"versions": [
|
||||
{
|
||||
"version": "157.0.8103.78",
|
||||
"status": "affected",
|
||||
"lessThan": "157.0.8103.78",
|
||||
"versionType": "custom"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Type confusion in Turbolev in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Type confusion",
|
||||
"cweId": "CWE-843"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"shortName": "Chrome",
|
||||
"dateUpdated": "2026-11-11T22:39:00.467Z"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"
|
||||
},
|
||||
{
|
||||
"url": "https://issues.chromium.org/issues/578322433"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126844",
|
||||
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Chrome",
|
||||
"dateReserved": "2026-11-11T22:07:55.318Z",
|
||||
"datePublished": "2026-11-11T22:38:57.088Z",
|
||||
"dateUpdated": "2026-11-11T22:38:57.088Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Google",
|
||||
"product": "Chrome",
|
||||
"versions": [
|
||||
{
|
||||
"version": "157.0.8103.78",
|
||||
"status": "affected",
|
||||
"lessThan": "157.0.8103.78",
|
||||
"versionType": "custom"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Uninitialized resource in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)"
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Uninitialized resource",
|
||||
"cweId": "CWE-908"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"shortName": "Chrome",
|
||||
"dateUpdated": "2026-11-11T22:38:57.088Z"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"
|
||||
},
|
||||
{
|
||||
"url": "https://issues.chromium.org/issues/576944655"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126845",
|
||||
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Chrome",
|
||||
"dateReserved": "2026-11-11T22:07:57.527Z",
|
||||
"datePublished": "2026-11-11T22:38:54.636Z",
|
||||
"dateUpdated": "2026-11-11T22:38:54.636Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Google",
|
||||
"product": "Chrome",
|
||||
"versions": [
|
||||
{
|
||||
"version": "157.0.8103.78",
|
||||
"status": "affected",
|
||||
"lessThan": "157.0.8103.78",
|
||||
"versionType": "custom"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Uninitialized resource in GPU in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to potentially read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)"
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Uninitialized resource",
|
||||
"cweId": "CWE-908"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"shortName": "Chrome",
|
||||
"dateUpdated": "2026-11-11T22:38:54.636Z"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"
|
||||
},
|
||||
{
|
||||
"url": "https://issues.chromium.org/issues/574795295"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126846",
|
||||
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Chrome",
|
||||
"dateReserved": "2026-11-11T22:07:58.867Z",
|
||||
"datePublished": "2026-11-11T22:38:49.580Z",
|
||||
"dateUpdated": "2026-11-11T22:38:49.580Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Google",
|
||||
"product": "Chrome",
|
||||
"versions": [
|
||||
{
|
||||
"version": "157.0.8103.78",
|
||||
"status": "affected",
|
||||
"lessThan": "157.0.8103.78",
|
||||
"versionType": "custom"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Use after free in Skia in Google Chrome on on Android prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Use after free",
|
||||
"cweId": "CWE-416"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"shortName": "Chrome",
|
||||
"dateUpdated": "2026-11-11T22:38:49.580Z"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"
|
||||
},
|
||||
{
|
||||
"url": "https://issues.chromium.org/issues/580857377"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126847",
|
||||
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Chrome",
|
||||
"dateReserved": "2026-11-11T22:08:02.103Z",
|
||||
"datePublished": "2026-11-11T22:38:51.851Z",
|
||||
"dateUpdated": "2026-11-11T22:38:51.851Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Google",
|
||||
"product": "Chrome",
|
||||
"versions": [
|
||||
{
|
||||
"version": "157.0.8103.78",
|
||||
"status": "affected",
|
||||
"lessThan": "157.0.8103.78",
|
||||
"versionType": "custom"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Type confusion in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Type confusion",
|
||||
"cweId": "CWE-843"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"shortName": "Chrome",
|
||||
"dateUpdated": "2026-11-11T22:38:51.851Z"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"
|
||||
},
|
||||
{
|
||||
"url": "https://issues.chromium.org/issues/572988453"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126848",
|
||||
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Chrome",
|
||||
"dateReserved": "2026-11-11T22:08:03.608Z",
|
||||
"datePublished": "2026-11-11T22:39:02.390Z",
|
||||
"dateUpdated": "2026-11-11T22:39:02.390Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Google",
|
||||
"product": "Chrome",
|
||||
"versions": [
|
||||
{
|
||||
"version": "157.0.8103.78",
|
||||
"status": "affected",
|
||||
"lessThan": "157.0.8103.78",
|
||||
"versionType": "custom"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Uninitialized resource in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)"
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Uninitialized resource",
|
||||
"cweId": "CWE-908"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"shortName": "Chrome",
|
||||
"dateUpdated": "2026-11-11T22:39:02.390Z"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"
|
||||
},
|
||||
{
|
||||
"url": "https://issues.chromium.org/issues/578685477"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126849",
|
||||
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Chrome",
|
||||
"dateReserved": "2026-11-11T22:08:06.301Z",
|
||||
"datePublished": "2026-11-11T22:39:04.418Z",
|
||||
"dateUpdated": "2026-11-11T22:39:04.418Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Google",
|
||||
"product": "Chrome",
|
||||
"versions": [
|
||||
{
|
||||
"version": "157.0.8103.78",
|
||||
"status": "affected",
|
||||
"lessThan": "157.0.8103.78",
|
||||
"versionType": "custom"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Type confusion in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Type confusion",
|
||||
"cweId": "CWE-843"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"shortName": "Chrome",
|
||||
"dateUpdated": "2026-11-11T22:39:04.418Z"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"
|
||||
},
|
||||
{
|
||||
"url": "https://issues.chromium.org/issues/579313193"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126850",
|
||||
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Chrome",
|
||||
"dateReserved": "2026-11-11T22:08:08.016Z",
|
||||
"datePublished": "2026-11-11T22:39:04.951Z",
|
||||
"dateUpdated": "2026-11-11T22:39:04.951Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Google",
|
||||
"product": "Chrome",
|
||||
"versions": [
|
||||
{
|
||||
"version": "157.0.8103.78",
|
||||
"status": "affected",
|
||||
"lessThan": "157.0.8103.78",
|
||||
"versionType": "custom"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Incorrect authorization in SiteIsolation in Google Chrome on on Android prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: High)"
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Incorrect authorization",
|
||||
"cweId": "CWE-863"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"shortName": "Chrome",
|
||||
"dateUpdated": "2026-11-11T22:39:04.951Z"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"
|
||||
},
|
||||
{
|
||||
"url": "https://issues.chromium.org/issues/580853808"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126851",
|
||||
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Chrome",
|
||||
"dateReserved": "2026-11-11T22:08:09.387Z",
|
||||
"datePublished": "2026-11-11T22:38:54.463Z",
|
||||
"dateUpdated": "2026-11-11T22:38:54.463Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Google",
|
||||
"product": "Chrome",
|
||||
"versions": [
|
||||
{
|
||||
"version": "157.0.8103.78",
|
||||
"status": "affected",
|
||||
"lessThan": "157.0.8103.78",
|
||||
"versionType": "custom"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Use after free in Accessibility in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Use after free",
|
||||
"cweId": "CWE-416"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"shortName": "Chrome",
|
||||
"dateUpdated": "2026-11-11T22:38:54.463Z"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"
|
||||
},
|
||||
{
|
||||
"url": "https://issues.chromium.org/issues/574792758"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126852",
|
||||
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Chrome",
|
||||
"dateReserved": "2026-11-11T22:08:11.726Z",
|
||||
"datePublished": "2026-11-11T22:39:04.769Z",
|
||||
"dateUpdated": "2026-11-11T22:39:04.769Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Google",
|
||||
"product": "Chrome",
|
||||
"versions": [
|
||||
{
|
||||
"version": "157.0.8103.78",
|
||||
"status": "affected",
|
||||
"lessThan": "157.0.8103.78",
|
||||
"versionType": "custom"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Use after free in MediaStream in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Use after free",
|
||||
"cweId": "CWE-416"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"shortName": "Chrome",
|
||||
"dateUpdated": "2026-11-11T22:39:04.769Z"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"
|
||||
},
|
||||
{
|
||||
"url": "https://issues.chromium.org/issues/580846651"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126853",
|
||||
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Chrome",
|
||||
"dateReserved": "2026-11-11T22:08:13.890Z",
|
||||
"datePublished": "2026-11-11T22:38:52.045Z",
|
||||
"dateUpdated": "2026-11-11T22:38:52.045Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Google",
|
||||
"product": "Chrome",
|
||||
"versions": [
|
||||
{
|
||||
"version": "157.0.8103.78",
|
||||
"status": "affected",
|
||||
"lessThan": "157.0.8103.78",
|
||||
"versionType": "custom"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Uninitialized resource in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)"
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Uninitialized resource",
|
||||
"cweId": "CWE-908"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"shortName": "Chrome",
|
||||
"dateUpdated": "2026-11-11T22:38:52.045Z"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"
|
||||
},
|
||||
{
|
||||
"url": "https://issues.chromium.org/issues/573263421"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126854",
|
||||
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Chrome",
|
||||
"dateReserved": "2026-11-11T22:08:16.441Z",
|
||||
"datePublished": "2026-11-11T22:39:00.666Z",
|
||||
"dateUpdated": "2026-11-11T22:39:00.666Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Google",
|
||||
"product": "Chrome",
|
||||
"versions": [
|
||||
{
|
||||
"version": "157.0.8103.78",
|
||||
"status": "affected",
|
||||
"lessThan": "157.0.8103.78",
|
||||
"versionType": "custom"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Incorrect authorization in Layout in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)"
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Incorrect authorization",
|
||||
"cweId": "CWE-863"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"shortName": "Chrome",
|
||||
"dateUpdated": "2026-11-11T22:39:00.666Z"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"
|
||||
},
|
||||
{
|
||||
"url": "https://issues.chromium.org/issues/578655807"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126855",
|
||||
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Chrome",
|
||||
"dateReserved": "2026-11-11T22:08:20.104Z",
|
||||
"datePublished": "2026-11-11T22:39:04.046Z",
|
||||
"dateUpdated": "2026-11-11T22:39:04.046Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Google",
|
||||
"product": "Chrome",
|
||||
"versions": [
|
||||
{
|
||||
"version": "157.0.8103.78",
|
||||
"status": "affected",
|
||||
"lessThan": "157.0.8103.78",
|
||||
"versionType": "custom"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Missing authorization in ImageCapture in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)"
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Missing authorization",
|
||||
"cweId": "CWE-862"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"shortName": "Chrome",
|
||||
"dateUpdated": "2026-11-11T22:39:04.046Z"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"
|
||||
},
|
||||
{
|
||||
"url": "https://issues.chromium.org/issues/579300424"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126856",
|
||||
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Chrome",
|
||||
"dateReserved": "2026-11-11T22:08:23.429Z",
|
||||
"datePublished": "2026-11-11T22:38:58.741Z",
|
||||
"dateUpdated": "2026-11-11T22:38:58.741Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Google",
|
||||
"product": "Chrome",
|
||||
"versions": [
|
||||
{
|
||||
"version": "157.0.8103.78",
|
||||
"status": "affected",
|
||||
"lessThan": "157.0.8103.78",
|
||||
"versionType": "custom"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Incomplete cleanup in Cache in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)"
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Incomplete cleanup",
|
||||
"cweId": "CWE-459"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"shortName": "Chrome",
|
||||
"dateUpdated": "2026-11-11T22:38:58.741Z"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"
|
||||
},
|
||||
{
|
||||
"url": "https://issues.chromium.org/issues/577260644"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126857",
|
||||
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Chrome",
|
||||
"dateReserved": "2026-11-11T22:08:25.097Z",
|
||||
"datePublished": "2026-11-11T22:39:01.261Z",
|
||||
"dateUpdated": "2026-11-11T22:39:01.261Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Google",
|
||||
"product": "Chrome",
|
||||
"versions": [
|
||||
{
|
||||
"version": "157.0.8103.78",
|
||||
"status": "affected",
|
||||
"lessThan": "157.0.8103.78",
|
||||
"versionType": "custom"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Out of bounds read in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)"
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Out of bounds read",
|
||||
"cweId": "CWE-125"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"shortName": "Chrome",
|
||||
"dateUpdated": "2026-11-11T22:39:01.261Z"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"
|
||||
},
|
||||
{
|
||||
"url": "https://issues.chromium.org/issues/578656869"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126858",
|
||||
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Chrome",
|
||||
"dateReserved": "2026-11-11T22:08:26.820Z",
|
||||
"datePublished": "2026-11-11T22:38:55.899Z",
|
||||
"dateUpdated": "2026-11-11T22:38:55.899Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Google",
|
||||
"product": "Chrome",
|
||||
"versions": [
|
||||
{
|
||||
"version": "157.0.8103.78",
|
||||
"status": "affected",
|
||||
"lessThan": "157.0.8103.78",
|
||||
"versionType": "custom"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 157.0.8103.78 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)"
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Uninitialized resource",
|
||||
"cweId": "CWE-908"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"shortName": "Chrome",
|
||||
"dateUpdated": "2026-11-11T22:38:55.899Z"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"
|
||||
},
|
||||
{
|
||||
"url": "https://issues.chromium.org/issues/575937643"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126859",
|
||||
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Chrome",
|
||||
"dateReserved": "2026-11-11T22:08:28.574Z",
|
||||
"datePublished": "2026-11-11T22:38:50.329Z",
|
||||
"dateUpdated": "2026-11-11T22:38:50.329Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Google",
|
||||
"product": "Chrome",
|
||||
"versions": [
|
||||
{
|
||||
"version": "157.0.8103.78",
|
||||
"status": "affected",
|
||||
"lessThan": "157.0.8103.78",
|
||||
"versionType": "custom"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Link following in FileSystem in Google Chrome prior to 157.0.8103.78 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Link following",
|
||||
"cweId": "CWE-59"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"shortName": "Chrome",
|
||||
"dateUpdated": "2026-11-11T22:38:50.329Z"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"
|
||||
},
|
||||
{
|
||||
"url": "https://issues.chromium.org/issues/563340397"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126860",
|
||||
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Chrome",
|
||||
"dateReserved": "2026-11-11T22:08:34.791Z",
|
||||
"datePublished": "2026-11-11T22:39:06.337Z",
|
||||
"dateUpdated": "2026-11-11T22:39:06.337Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Google",
|
||||
"product": "Chrome",
|
||||
"versions": [
|
||||
{
|
||||
"version": "157.0.8103.78",
|
||||
"status": "affected",
|
||||
"lessThan": "157.0.8103.78",
|
||||
"versionType": "custom"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.78 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Incorrect authorization",
|
||||
"cweId": "CWE-863"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"shortName": "Chrome",
|
||||
"dateUpdated": "2026-11-11T22:39:06.337Z"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"
|
||||
},
|
||||
{
|
||||
"url": "https://issues.chromium.org/issues/581785712"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126861",
|
||||
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Chrome",
|
||||
"dateReserved": "2026-11-11T22:08:38.372Z",
|
||||
"datePublished": "2026-11-11T22:38:58.357Z",
|
||||
"dateUpdated": "2026-11-11T22:38:58.357Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Google",
|
||||
"product": "Chrome",
|
||||
"versions": [
|
||||
{
|
||||
"version": "157.0.8103.78",
|
||||
"status": "affected",
|
||||
"lessThan": "157.0.8103.78",
|
||||
"versionType": "custom"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Use after free in Media in Google Chrome on on Android prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Use after free",
|
||||
"cweId": "CWE-416"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"shortName": "Chrome",
|
||||
"dateUpdated": "2026-11-11T22:38:58.357Z"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"
|
||||
},
|
||||
{
|
||||
"url": "https://issues.chromium.org/issues/577171064"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126862",
|
||||
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Chrome",
|
||||
"dateReserved": "2026-11-11T22:08:39.762Z",
|
||||
"datePublished": "2026-11-11T22:38:53.724Z",
|
||||
"dateUpdated": "2026-11-11T22:38:53.724Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Google",
|
||||
"product": "Chrome",
|
||||
"versions": [
|
||||
{
|
||||
"version": "157.0.8103.78",
|
||||
"status": "affected",
|
||||
"lessThan": "157.0.8103.78",
|
||||
"versionType": "custom"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Improper input validation in Core in Google Chrome on on Android prior to 157.0.8103.78 allowed a local attacker to bypass web origin policy via a co-installed app. (Chromium security severity: High)"
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Improper input validation",
|
||||
"cweId": "CWE-20"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"shortName": "Chrome",
|
||||
"dateUpdated": "2026-11-11T22:38:53.724Z"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"
|
||||
},
|
||||
{
|
||||
"url": "https://issues.chromium.org/issues/574381704"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126863",
|
||||
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Chrome",
|
||||
"dateReserved": "2026-11-11T22:08:41.169Z",
|
||||
"datePublished": "2026-11-11T22:38:55.206Z",
|
||||
"dateUpdated": "2026-11-11T22:38:55.206Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Google",
|
||||
"product": "Chrome",
|
||||
"versions": [
|
||||
{
|
||||
"version": "157.0.8103.78",
|
||||
"status": "affected",
|
||||
"lessThan": "157.0.8103.78",
|
||||
"versionType": "custom"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Use after free in HTML in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Use after free",
|
||||
"cweId": "CWE-416"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"shortName": "Chrome",
|
||||
"dateUpdated": "2026-11-11T22:38:55.206Z"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"
|
||||
},
|
||||
{
|
||||
"url": "https://issues.chromium.org/issues/575312521"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126864",
|
||||
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Chrome",
|
||||
"dateReserved": "2026-11-11T22:08:44.870Z",
|
||||
"datePublished": "2026-11-11T22:38:49.953Z",
|
||||
"dateUpdated": "2026-11-11T22:38:49.953Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Google",
|
||||
"product": "Chrome",
|
||||
"versions": [
|
||||
{
|
||||
"version": "157.0.8103.78",
|
||||
"status": "affected",
|
||||
"lessThan": "157.0.8103.78",
|
||||
"versionType": "custom"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Use after free in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Use after free",
|
||||
"cweId": "CWE-416"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"shortName": "Chrome",
|
||||
"dateUpdated": "2026-11-11T22:38:49.953Z"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"
|
||||
},
|
||||
{
|
||||
"url": "https://issues.chromium.org/issues/567827593"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126865",
|
||||
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Chrome",
|
||||
"dateReserved": "2026-11-11T22:08:49.021Z",
|
||||
"datePublished": "2026-11-11T22:38:52.219Z",
|
||||
"dateUpdated": "2026-11-11T22:38:52.219Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Google",
|
||||
"product": "Chrome",
|
||||
"versions": [
|
||||
{
|
||||
"version": "157.0.8103.78",
|
||||
"status": "affected",
|
||||
"lessThan": "157.0.8103.78",
|
||||
"versionType": "custom"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Use after free in DOM in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Use after free",
|
||||
"cweId": "CWE-416"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"shortName": "Chrome",
|
||||
"dateUpdated": "2026-11-11T22:38:52.219Z"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"
|
||||
},
|
||||
{
|
||||
"url": "https://issues.chromium.org/issues/573335176"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126866",
|
||||
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Chrome",
|
||||
"dateReserved": "2026-11-11T22:08:55.144Z",
|
||||
"datePublished": "2026-11-11T22:38:56.839Z",
|
||||
"dateUpdated": "2026-11-11T22:38:56.839Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Google",
|
||||
"product": "Chrome",
|
||||
"versions": [
|
||||
{
|
||||
"version": "157.0.8103.78",
|
||||
"status": "affected",
|
||||
"lessThan": "157.0.8103.78",
|
||||
"versionType": "custom"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Incorrect authorization in Extensions in Google Chrome prior to 157.0.8103.78 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted Chrome extension. (Chromium security severity: High)"
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Incorrect authorization",
|
||||
"cweId": "CWE-863"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"shortName": "Chrome",
|
||||
"dateUpdated": "2026-11-11T22:38:56.839Z"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"
|
||||
},
|
||||
{
|
||||
"url": "https://issues.chromium.org/issues/576943246"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126867",
|
||||
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Chrome",
|
||||
"dateReserved": "2026-11-11T22:08:57.711Z",
|
||||
"datePublished": "2026-11-11T22:38:55.032Z",
|
||||
"dateUpdated": "2026-11-11T22:38:55.032Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Google",
|
||||
"product": "Chrome",
|
||||
"versions": [
|
||||
{
|
||||
"version": "157.0.8103.78",
|
||||
"status": "affected",
|
||||
"lessThan": "157.0.8103.78",
|
||||
"versionType": "custom"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Use after free in Browser in Google Chrome on on Windows prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Use after free",
|
||||
"cweId": "CWE-416"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"shortName": "Chrome",
|
||||
"dateUpdated": "2026-11-11T22:38:55.032Z"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"
|
||||
},
|
||||
{
|
||||
"url": "https://issues.chromium.org/issues/575086736"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126868",
|
||||
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Chrome",
|
||||
"dateReserved": "2026-11-11T22:08:59.773Z",
|
||||
"datePublished": "2026-11-11T22:39:05.596Z",
|
||||
"dateUpdated": "2026-11-11T22:39:05.596Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Google",
|
||||
"product": "Chrome",
|
||||
"versions": [
|
||||
{
|
||||
"version": "157.0.8103.78",
|
||||
"status": "affected",
|
||||
"lessThan": "157.0.8103.78",
|
||||
"versionType": "custom"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Type confusion in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Type confusion",
|
||||
"cweId": "CWE-843"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"shortName": "Chrome",
|
||||
"dateUpdated": "2026-11-11T22:39:05.596Z"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"
|
||||
},
|
||||
{
|
||||
"url": "https://issues.chromium.org/issues/580867734"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126869",
|
||||
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Chrome",
|
||||
"dateReserved": "2026-11-11T22:09:03.499Z",
|
||||
"datePublished": "2026-11-11T22:38:55.593Z",
|
||||
"dateUpdated": "2026-11-11T22:38:55.593Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Google",
|
||||
"product": "Chrome",
|
||||
"versions": [
|
||||
{
|
||||
"version": "157.0.8103.78",
|
||||
"status": "affected",
|
||||
"lessThan": "157.0.8103.78",
|
||||
"versionType": "custom"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Use after free in Frames in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Use after free",
|
||||
"cweId": "CWE-416"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"shortName": "Chrome",
|
||||
"dateUpdated": "2026-11-11T22:38:55.593Z"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"
|
||||
},
|
||||
{
|
||||
"url": "https://issues.chromium.org/issues/575533210"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126870",
|
||||
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Chrome",
|
||||
"dateReserved": "2026-11-11T22:09:05.241Z",
|
||||
"datePublished": "2026-11-11T22:38:50.952Z",
|
||||
"dateUpdated": "2026-11-11T22:38:50.952Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Google",
|
||||
"product": "Chrome",
|
||||
"versions": [
|
||||
{
|
||||
"version": "157.0.8103.78",
|
||||
"status": "affected",
|
||||
"lessThan": "157.0.8103.78",
|
||||
"versionType": "custom"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Uninitialized resource in ANGLE in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)"
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Uninitialized resource",
|
||||
"cweId": "CWE-908"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"shortName": "Chrome",
|
||||
"dateUpdated": "2026-11-11T22:38:50.952Z"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"
|
||||
},
|
||||
{
|
||||
"url": "https://issues.chromium.org/issues/568906910"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126871",
|
||||
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Chrome",
|
||||
"dateReserved": "2026-11-11T22:09:07.618Z",
|
||||
"datePublished": "2026-11-11T22:38:53.354Z",
|
||||
"dateUpdated": "2026-11-11T22:38:53.354Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Google",
|
||||
"product": "Chrome",
|
||||
"versions": [
|
||||
{
|
||||
"version": "157.0.8103.78",
|
||||
"status": "affected",
|
||||
"lessThan": "157.0.8103.78",
|
||||
"versionType": "custom"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Out of bounds read in Skia in Google Chrome on on Mac prior to 157.0.8103.78 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)"
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Out of bounds read",
|
||||
"cweId": "CWE-125"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"shortName": "Chrome",
|
||||
"dateUpdated": "2026-11-11T22:38:53.354Z"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"
|
||||
},
|
||||
{
|
||||
"url": "https://issues.chromium.org/issues/574218401"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126872",
|
||||
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Chrome",
|
||||
"dateReserved": "2026-11-11T22:09:13.347Z",
|
||||
"datePublished": "2026-11-11T22:38:59.905Z",
|
||||
"dateUpdated": "2026-11-11T22:38:59.905Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Google",
|
||||
"product": "Chrome",
|
||||
"versions": [
|
||||
{
|
||||
"version": "157.0.8103.78",
|
||||
"status": "affected",
|
||||
"lessThan": "157.0.8103.78",
|
||||
"versionType": "custom"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.78 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Incorrect authorization",
|
||||
"cweId": "CWE-863"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"shortName": "Chrome",
|
||||
"dateUpdated": "2026-11-11T22:38:59.905Z"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"
|
||||
},
|
||||
{
|
||||
"url": "https://issues.chromium.org/issues/577376424"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126873",
|
||||
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Chrome",
|
||||
"dateReserved": "2026-11-11T22:09:14.916Z",
|
||||
"datePublished": "2026-11-11T22:38:59.165Z",
|
||||
"dateUpdated": "2026-11-11T22:38:59.165Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Google",
|
||||
"product": "Chrome",
|
||||
"versions": [
|
||||
{
|
||||
"version": "157.0.8103.78",
|
||||
"status": "affected",
|
||||
"lessThan": "157.0.8103.78",
|
||||
"versionType": "custom"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Use after free in Extensions in Google Chrome on on Windows prior to 157.0.8103.78 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Use after free",
|
||||
"cweId": "CWE-416"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"shortName": "Chrome",
|
||||
"dateUpdated": "2026-11-11T22:38:59.165Z"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"
|
||||
},
|
||||
{
|
||||
"url": "https://issues.chromium.org/issues/577336494"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126874",
|
||||
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Chrome",
|
||||
"dateReserved": "2026-11-11T22:09:19.769Z",
|
||||
"datePublished": "2026-11-11T22:38:56.268Z",
|
||||
"dateUpdated": "2026-11-11T22:38:56.268Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Google",
|
||||
"product": "Chrome",
|
||||
"versions": [
|
||||
{
|
||||
"version": "157.0.8103.78",
|
||||
"status": "affected",
|
||||
"lessThan": "157.0.8103.78",
|
||||
"versionType": "custom"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Type confusion in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Type confusion",
|
||||
"cweId": "CWE-843"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"shortName": "Chrome",
|
||||
"dateUpdated": "2026-11-11T22:38:56.268Z"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"
|
||||
},
|
||||
{
|
||||
"url": "https://issues.chromium.org/issues/576439987"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126875",
|
||||
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Chrome",
|
||||
"dateReserved": "2026-11-11T22:09:21.159Z",
|
||||
"datePublished": "2026-11-11T22:38:53.539Z",
|
||||
"dateUpdated": "2026-11-11T22:38:53.539Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Google",
|
||||
"product": "Chrome",
|
||||
"versions": [
|
||||
{
|
||||
"version": "157.0.8103.78",
|
||||
"status": "affected",
|
||||
"lessThan": "157.0.8103.78",
|
||||
"versionType": "custom"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Missing authorization in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)"
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Missing authorization",
|
||||
"cweId": "CWE-862"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"shortName": "Chrome",
|
||||
"dateUpdated": "2026-11-11T22:38:53.539Z"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"
|
||||
},
|
||||
{
|
||||
"url": "https://issues.chromium.org/issues/574222006"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126876",
|
||||
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Chrome",
|
||||
"dateReserved": "2026-11-11T22:09:22.365Z",
|
||||
"datePublished": "2026-11-11T22:38:56.452Z",
|
||||
"dateUpdated": "2026-11-11T22:38:56.452Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Google",
|
||||
"product": "Chrome",
|
||||
"versions": [
|
||||
{
|
||||
"version": "157.0.8103.78",
|
||||
"status": "affected",
|
||||
"lessThan": "157.0.8103.78",
|
||||
"versionType": "custom"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Integer overflow in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Integer overflow",
|
||||
"cweId": "CWE-190"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"shortName": "Chrome",
|
||||
"dateUpdated": "2026-11-11T22:38:56.452Z"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"
|
||||
},
|
||||
{
|
||||
"url": "https://issues.chromium.org/issues/576664769"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126877",
|
||||
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Chrome",
|
||||
"dateReserved": "2026-11-11T22:09:23.937Z",
|
||||
"datePublished": "2026-11-11T22:39:00.090Z",
|
||||
"dateUpdated": "2026-11-11T22:39:00.090Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Google",
|
||||
"product": "Chrome",
|
||||
"versions": [
|
||||
{
|
||||
"version": "157.0.8103.78",
|
||||
"status": "affected",
|
||||
"lessThan": "157.0.8103.78",
|
||||
"versionType": "custom"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Use after free in Dawn in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Use after free",
|
||||
"cweId": "CWE-416"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"shortName": "Chrome",
|
||||
"dateUpdated": "2026-11-11T22:39:00.090Z"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"
|
||||
},
|
||||
{
|
||||
"url": "https://issues.chromium.org/issues/577377985"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126878",
|
||||
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Chrome",
|
||||
"dateReserved": "2026-11-11T22:09:35.182Z",
|
||||
"datePublished": "2026-11-11T22:38:51.487Z",
|
||||
"dateUpdated": "2026-11-11T22:38:51.487Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Google",
|
||||
"product": "Chrome",
|
||||
"versions": [
|
||||
{
|
||||
"version": "157.0.8103.78",
|
||||
"status": "affected",
|
||||
"lessThan": "157.0.8103.78",
|
||||
"versionType": "custom"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Information leak in Core in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)"
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Information leak",
|
||||
"cweId": "CWE-200"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"shortName": "Chrome",
|
||||
"dateUpdated": "2026-11-11T22:38:51.487Z"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"
|
||||
},
|
||||
{
|
||||
"url": "https://issues.chromium.org/issues/572312779"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126879",
|
||||
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Chrome",
|
||||
"dateReserved": "2026-11-11T22:09:38.878Z",
|
||||
"datePublished": "2026-11-11T22:38:49.336Z",
|
||||
"dateUpdated": "2026-11-11T22:38:49.336Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Google",
|
||||
"product": "Chrome",
|
||||
"versions": [
|
||||
{
|
||||
"version": "157.0.8103.78",
|
||||
"status": "affected",
|
||||
"lessThan": "157.0.8103.78",
|
||||
"versionType": "custom"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Use after free in Layout in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Use after free",
|
||||
"cweId": "CWE-416"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"shortName": "Chrome",
|
||||
"dateUpdated": "2026-11-11T22:38:49.336Z"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"
|
||||
},
|
||||
{
|
||||
"url": "https://issues.chromium.org/issues/576736463"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126880",
|
||||
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Chrome",
|
||||
"dateReserved": "2026-11-11T22:09:44.649Z",
|
||||
"datePublished": "2026-11-11T22:38:59.706Z",
|
||||
"dateUpdated": "2026-11-11T22:38:59.706Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Google",
|
||||
"product": "Chrome",
|
||||
"versions": [
|
||||
{
|
||||
"version": "157.0.8103.78",
|
||||
"status": "affected",
|
||||
"lessThan": "157.0.8103.78",
|
||||
"versionType": "custom"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Type confusion in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Type confusion",
|
||||
"cweId": "CWE-843"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"shortName": "Chrome",
|
||||
"dateUpdated": "2026-11-11T22:38:59.706Z"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"
|
||||
},
|
||||
{
|
||||
"url": "https://issues.chromium.org/issues/577366752"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126881",
|
||||
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Chrome",
|
||||
"dateReserved": "2026-11-11T22:09:46.449Z",
|
||||
"datePublished": "2026-11-11T22:38:54.833Z",
|
||||
"dateUpdated": "2026-11-11T22:38:54.833Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Google",
|
||||
"product": "Chrome",
|
||||
"versions": [
|
||||
{
|
||||
"version": "157.0.8103.78",
|
||||
"status": "affected",
|
||||
"lessThan": "157.0.8103.78",
|
||||
"versionType": "custom"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Improper initialization in Media in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Improper initialization",
|
||||
"cweId": "CWE-665"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"shortName": "Chrome",
|
||||
"dateUpdated": "2026-11-11T22:38:54.833Z"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"
|
||||
},
|
||||
{
|
||||
"url": "https://issues.chromium.org/issues/575038730"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126882",
|
||||
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Chrome",
|
||||
"dateReserved": "2026-11-11T22:09:47.798Z",
|
||||
"datePublished": "2026-11-11T22:39:02.751Z",
|
||||
"dateUpdated": "2026-11-11T22:39:02.751Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Google",
|
||||
"product": "Chrome",
|
||||
"versions": [
|
||||
{
|
||||
"version": "157.0.8103.78",
|
||||
"status": "affected",
|
||||
"lessThan": "157.0.8103.78",
|
||||
"versionType": "custom"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Information leak in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)"
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Information leak",
|
||||
"cweId": "CWE-200"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"shortName": "Chrome",
|
||||
"dateUpdated": "2026-11-11T22:39:02.751Z"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"
|
||||
},
|
||||
{
|
||||
"url": "https://issues.chromium.org/issues/578685706"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126883",
|
||||
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Chrome",
|
||||
"dateReserved": "2026-11-11T22:09:49.532Z",
|
||||
"datePublished": "2026-11-11T22:39:01.657Z",
|
||||
"dateUpdated": "2026-11-11T22:39:01.657Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Google",
|
||||
"product": "Chrome",
|
||||
"versions": [
|
||||
{
|
||||
"version": "157.0.8103.78",
|
||||
"status": "affected",
|
||||
"lessThan": "157.0.8103.78",
|
||||
"versionType": "custom"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Use after free in Core in Google Chrome on on Windows prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Use after free",
|
||||
"cweId": "CWE-416"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"shortName": "Chrome",
|
||||
"dateUpdated": "2026-11-11T22:39:01.657Z"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"
|
||||
},
|
||||
{
|
||||
"url": "https://issues.chromium.org/issues/578659604"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126884",
|
||||
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Chrome",
|
||||
"dateReserved": "2026-11-11T22:09:51.172Z",
|
||||
"datePublished": "2026-11-11T22:38:57.990Z",
|
||||
"dateUpdated": "2026-11-11T22:38:57.990Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Google",
|
||||
"product": "Chrome",
|
||||
"versions": [
|
||||
{
|
||||
"version": "157.0.8103.78",
|
||||
"status": "affected",
|
||||
"lessThan": "157.0.8103.78",
|
||||
"versionType": "custom"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Out of bounds read in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)"
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Out of bounds read",
|
||||
"cweId": "CWE-125"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"shortName": "Chrome",
|
||||
"dateUpdated": "2026-11-11T22:38:57.990Z"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"
|
||||
},
|
||||
{
|
||||
"url": "https://issues.chromium.org/issues/576949530"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126885",
|
||||
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Chrome",
|
||||
"dateReserved": "2026-11-11T22:09:54.442Z",
|
||||
"datePublished": "2026-11-11T22:38:48.798Z",
|
||||
"dateUpdated": "2026-11-11T22:38:48.798Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Google",
|
||||
"product": "Chrome",
|
||||
"versions": [
|
||||
{
|
||||
"version": "157.0.8103.78",
|
||||
"status": "affected",
|
||||
"lessThan": "157.0.8103.78",
|
||||
"versionType": "custom"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Use after free in ServiceWorker in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Use after free",
|
||||
"cweId": "CWE-416"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"shortName": "Chrome",
|
||||
"dateUpdated": "2026-11-11T22:38:48.798Z"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"
|
||||
},
|
||||
{
|
||||
"url": "https://issues.chromium.org/issues/568699166"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126886",
|
||||
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Chrome",
|
||||
"dateReserved": "2026-11-11T22:09:57.497Z",
|
||||
"datePublished": "2026-11-11T22:38:50.583Z",
|
||||
"dateUpdated": "2026-11-11T22:38:50.583Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Google",
|
||||
"product": "Chrome",
|
||||
"versions": [
|
||||
{
|
||||
"version": "157.0.8103.78",
|
||||
"status": "affected",
|
||||
"lessThan": "157.0.8103.78",
|
||||
"versionType": "custom"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Use after free in Frames in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Use after free",
|
||||
"cweId": "CWE-416"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"shortName": "Chrome",
|
||||
"dateUpdated": "2026-11-11T22:38:50.583Z"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"
|
||||
},
|
||||
{
|
||||
"url": "https://issues.chromium.org/issues/567611696"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126887",
|
||||
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Chrome",
|
||||
"dateReserved": "2026-11-11T22:10:00.700Z",
|
||||
"datePublished": "2026-11-11T22:38:50.760Z",
|
||||
"dateUpdated": "2026-11-11T22:38:50.760Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Google",
|
||||
"product": "Chrome",
|
||||
"versions": [
|
||||
{
|
||||
"version": "157.0.8103.78",
|
||||
"status": "affected",
|
||||
"lessThan": "157.0.8103.78",
|
||||
"versionType": "custom"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Use after free in Animation in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Use after free",
|
||||
"cweId": "CWE-416"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"shortName": "Chrome",
|
||||
"dateUpdated": "2026-11-11T22:38:50.760Z"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"
|
||||
},
|
||||
{
|
||||
"url": "https://issues.chromium.org/issues/567611698"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126888",
|
||||
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Chrome",
|
||||
"dateReserved": "2026-11-11T22:10:07.079Z",
|
||||
"datePublished": "2026-11-11T22:39:00.276Z",
|
||||
"dateUpdated": "2026-11-11T22:39:00.276Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Google",
|
||||
"product": "Chrome",
|
||||
"versions": [
|
||||
{
|
||||
"version": "157.0.8103.78",
|
||||
"status": "affected",
|
||||
"lessThan": "157.0.8103.78",
|
||||
"versionType": "custom"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Buffer overflow in Turbolev in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Buffer overflow",
|
||||
"cweId": "CWE-122"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"shortName": "Chrome",
|
||||
"dateUpdated": "2026-11-11T22:39:00.276Z"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"
|
||||
},
|
||||
{
|
||||
"url": "https://issues.chromium.org/issues/577461556"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126889",
|
||||
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Chrome",
|
||||
"dateReserved": "2026-11-11T22:10:09.068Z",
|
||||
"datePublished": "2026-11-11T22:38:50.139Z",
|
||||
"dateUpdated": "2026-11-11T22:38:50.139Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Google",
|
||||
"product": "Chrome",
|
||||
"versions": [
|
||||
{
|
||||
"version": "157.0.8103.78",
|
||||
"status": "affected",
|
||||
"lessThan": "157.0.8103.78",
|
||||
"versionType": "custom"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Off-by-one error in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Off-by-one error",
|
||||
"cweId": "CWE-193"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"shortName": "Chrome",
|
||||
"dateUpdated": "2026-11-11T22:38:50.139Z"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"
|
||||
},
|
||||
{
|
||||
"url": "https://issues.chromium.org/issues/560620348"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126890",
|
||||
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Chrome",
|
||||
"dateReserved": "2026-11-11T22:10:12.823Z",
|
||||
"datePublished": "2026-11-11T22:39:06.160Z",
|
||||
"dateUpdated": "2026-11-11T22:39:06.160Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Google",
|
||||
"product": "Chrome",
|
||||
"versions": [
|
||||
{
|
||||
"version": "157.0.8103.78",
|
||||
"status": "affected",
|
||||
"lessThan": "157.0.8103.78",
|
||||
"versionType": "custom"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Out of bounds read in Media in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Out of bounds read",
|
||||
"cweId": "CWE-125"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"shortName": "Chrome",
|
||||
"dateUpdated": "2026-11-11T22:39:06.160Z"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"
|
||||
},
|
||||
{
|
||||
"url": "https://issues.chromium.org/issues/581629247"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126891",
|
||||
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Chrome",
|
||||
"dateReserved": "2026-11-11T22:10:16.636Z",
|
||||
"datePublished": "2026-11-11T22:38:56.095Z",
|
||||
"dateUpdated": "2026-11-11T22:38:56.095Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Google",
|
||||
"product": "Chrome",
|
||||
"versions": [
|
||||
{
|
||||
"version": "157.0.8103.78",
|
||||
"status": "affected",
|
||||
"lessThan": "157.0.8103.78",
|
||||
"versionType": "custom"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Use after free in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: High)"
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Use after free",
|
||||
"cweId": "CWE-416"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"shortName": "Chrome",
|
||||
"dateUpdated": "2026-11-11T22:38:56.095Z"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"
|
||||
},
|
||||
{
|
||||
"url": "https://issues.chromium.org/issues/575939904"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126892",
|
||||
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Chrome",
|
||||
"dateReserved": "2026-11-11T22:10:18.158Z",
|
||||
"datePublished": "2026-11-11T22:39:00.870Z",
|
||||
"dateUpdated": "2026-11-11T22:39:00.870Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Google",
|
||||
"product": "Chrome",
|
||||
"versions": [
|
||||
{
|
||||
"version": "157.0.8103.78",
|
||||
"status": "affected",
|
||||
"lessThan": "157.0.8103.78",
|
||||
"versionType": "custom"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Use after free in MediaStream in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Use after free",
|
||||
"cweId": "CWE-416"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"shortName": "Chrome",
|
||||
"dateUpdated": "2026-11-11T22:39:00.870Z"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"
|
||||
},
|
||||
{
|
||||
"url": "https://issues.chromium.org/issues/578656065"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126893",
|
||||
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Chrome",
|
||||
"dateReserved": "2026-11-11T22:10:20.235Z",
|
||||
"datePublished": "2026-11-11T22:39:03.817Z",
|
||||
"dateUpdated": "2026-11-11T22:39:03.817Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Google",
|
||||
"product": "Chrome",
|
||||
"versions": [
|
||||
{
|
||||
"version": "157.0.8103.78",
|
||||
"status": "affected",
|
||||
"lessThan": "157.0.8103.78",
|
||||
"versionType": "custom"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Out of bounds write in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Out of bounds write",
|
||||
"cweId": "CWE-787"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"shortName": "Chrome",
|
||||
"dateUpdated": "2026-11-11T22:39:03.817Z"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"
|
||||
},
|
||||
{
|
||||
"url": "https://issues.chromium.org/issues/579278668"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126894",
|
||||
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Chrome",
|
||||
"dateReserved": "2026-11-11T22:10:22.388Z",
|
||||
"datePublished": "2026-11-11T22:38:58.184Z",
|
||||
"dateUpdated": "2026-11-11T22:38:58.184Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Google",
|
||||
"product": "Chrome",
|
||||
"versions": [
|
||||
{
|
||||
"version": "157.0.8103.78",
|
||||
"status": "affected",
|
||||
"lessThan": "157.0.8103.78",
|
||||
"versionType": "custom"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Out of bounds read in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)"
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Out of bounds read",
|
||||
"cweId": "CWE-125"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"shortName": "Chrome",
|
||||
"dateUpdated": "2026-11-11T22:38:58.184Z"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"
|
||||
},
|
||||
{
|
||||
"url": "https://issues.chromium.org/issues/576950618"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126895",
|
||||
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Chrome",
|
||||
"dateReserved": "2026-11-11T22:10:25.923Z",
|
||||
"datePublished": "2026-11-11T22:38:49.140Z",
|
||||
"dateUpdated": "2026-11-11T22:38:49.140Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Google",
|
||||
"product": "Chrome",
|
||||
"versions": [
|
||||
{
|
||||
"version": "157.0.8103.78",
|
||||
"status": "affected",
|
||||
"lessThan": "157.0.8103.78",
|
||||
"versionType": "custom"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Use after free in CSS in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Use after free",
|
||||
"cweId": "CWE-416"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"shortName": "Chrome",
|
||||
"dateUpdated": "2026-11-11T22:38:49.140Z"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"
|
||||
},
|
||||
{
|
||||
"url": "https://issues.chromium.org/issues/575524700"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126896",
|
||||
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Chrome",
|
||||
"dateReserved": "2026-11-11T22:10:29.259Z",
|
||||
"datePublished": "2026-11-11T22:38:55.392Z",
|
||||
"dateUpdated": "2026-11-11T22:38:55.392Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Google",
|
||||
"product": "Chrome",
|
||||
"versions": [
|
||||
{
|
||||
"version": "157.0.8103.78",
|
||||
"status": "affected",
|
||||
"lessThan": "157.0.8103.78",
|
||||
"versionType": "custom"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Missing authorization in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)"
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Missing authorization",
|
||||
"cweId": "CWE-862"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"shortName": "Chrome",
|
||||
"dateUpdated": "2026-11-11T22:38:55.392Z"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"
|
||||
},
|
||||
{
|
||||
"url": "https://issues.chromium.org/issues/575524702"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126897",
|
||||
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Chrome",
|
||||
"dateReserved": "2026-11-11T22:10:31.240Z",
|
||||
"datePublished": "2026-11-11T22:39:01.070Z",
|
||||
"dateUpdated": "2026-11-11T22:39:01.070Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Google",
|
||||
"product": "Chrome",
|
||||
"versions": [
|
||||
{
|
||||
"version": "157.0.8103.78",
|
||||
"status": "affected",
|
||||
"lessThan": "157.0.8103.78",
|
||||
"versionType": "custom"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Type confusion in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Type confusion",
|
||||
"cweId": "CWE-843"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"shortName": "Chrome",
|
||||
"dateUpdated": "2026-11-11T22:39:01.070Z"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"
|
||||
},
|
||||
{
|
||||
"url": "https://issues.chromium.org/issues/578656106"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126898",
|
||||
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Chrome",
|
||||
"dateReserved": "2026-11-11T22:10:33.234Z",
|
||||
"datePublished": "2026-11-11T22:38:53.164Z",
|
||||
"dateUpdated": "2026-11-11T22:38:53.164Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Google",
|
||||
"product": "Chrome",
|
||||
"versions": [
|
||||
{
|
||||
"version": "157.0.8103.78",
|
||||
"status": "affected",
|
||||
"lessThan": "157.0.8103.78",
|
||||
"versionType": "custom"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Uninitialized resource in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)"
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Uninitialized resource",
|
||||
"cweId": "CWE-908"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"shortName": "Chrome",
|
||||
"dateUpdated": "2026-11-11T22:38:53.164Z"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"
|
||||
},
|
||||
{
|
||||
"url": "https://issues.chromium.org/issues/574216555"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126899",
|
||||
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Chrome",
|
||||
"dateReserved": "2026-11-11T22:10:36.078Z",
|
||||
"datePublished": "2026-11-11T22:39:06.906Z",
|
||||
"dateUpdated": "2026-11-11T22:39:06.906Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Google",
|
||||
"product": "Chrome",
|
||||
"versions": [
|
||||
{
|
||||
"version": "157.0.8103.78",
|
||||
"status": "affected",
|
||||
"lessThan": "157.0.8103.78",
|
||||
"versionType": "custom"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Use after free in Elements in Google Chrome prior to 157.0.8103.78 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Use after free",
|
||||
"cweId": "CWE-416"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"shortName": "Chrome",
|
||||
"dateUpdated": "2026-11-11T22:39:06.906Z"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"
|
||||
},
|
||||
{
|
||||
"url": "https://issues.chromium.org/issues/583122799"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126900",
|
||||
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Chrome",
|
||||
"dateReserved": "2026-11-11T22:10:37.773Z",
|
||||
"datePublished": "2026-11-11T22:38:53.907Z",
|
||||
"dateUpdated": "2026-11-11T22:38:53.907Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Google",
|
||||
"product": "Chrome",
|
||||
"versions": [
|
||||
{
|
||||
"version": "157.0.8103.78",
|
||||
"status": "affected",
|
||||
"lessThan": "157.0.8103.78",
|
||||
"versionType": "custom"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Use after free in CSS in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Use after free",
|
||||
"cweId": "CWE-416"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"shortName": "Chrome",
|
||||
"dateUpdated": "2026-11-11T22:38:53.907Z"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"
|
||||
},
|
||||
{
|
||||
"url": "https://issues.chromium.org/issues/574409610"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126901",
|
||||
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Chrome",
|
||||
"dateReserved": "2026-11-11T22:10:41.209Z",
|
||||
"datePublished": "2026-11-11T22:39:04.596Z",
|
||||
"dateUpdated": "2026-11-11T22:39:04.596Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Google",
|
||||
"product": "Chrome",
|
||||
"versions": [
|
||||
{
|
||||
"version": "157.0.8103.78",
|
||||
"status": "affected",
|
||||
"lessThan": "157.0.8103.78",
|
||||
"versionType": "custom"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Use after free in PDF in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Use after free",
|
||||
"cweId": "CWE-416"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"shortName": "Chrome",
|
||||
"dateUpdated": "2026-11-11T22:39:04.596Z"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"
|
||||
},
|
||||
{
|
||||
"url": "https://issues.chromium.org/issues/579818899"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126902",
|
||||
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Chrome",
|
||||
"dateReserved": "2026-11-11T22:10:44.361Z",
|
||||
"datePublished": "2026-11-11T22:39:05.414Z",
|
||||
"dateUpdated": "2026-11-11T22:39:05.414Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Google",
|
||||
"product": "Chrome",
|
||||
"versions": [
|
||||
{
|
||||
"version": "157.0.8103.78",
|
||||
"status": "affected",
|
||||
"lessThan": "157.0.8103.78",
|
||||
"versionType": "custom"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Incorrect reference resolution in Browser in Google Chrome on on Mac prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Incorrect reference resolution",
|
||||
"cweId": "CWE-706"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"shortName": "Chrome",
|
||||
"dateUpdated": "2026-11-11T22:39:05.414Z"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"
|
||||
},
|
||||
{
|
||||
"url": "https://issues.chromium.org/issues/580867480"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126903",
|
||||
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Chrome",
|
||||
"dateReserved": "2026-11-11T22:10:47.870Z",
|
||||
"datePublished": "2026-11-11T22:38:52.584Z",
|
||||
"dateUpdated": "2026-11-11T22:38:52.584Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Google",
|
||||
"product": "Chrome",
|
||||
"versions": [
|
||||
{
|
||||
"version": "157.0.8103.78",
|
||||
"status": "affected",
|
||||
"lessThan": "157.0.8103.78",
|
||||
"versionType": "custom"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Improper state validation in ANGLE in Google Chrome on on Windows prior to 157.0.8103.78 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)"
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Improper state validation",
|
||||
"cweId": "CWE-754"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"shortName": "Chrome",
|
||||
"dateUpdated": "2026-11-11T22:38:52.584Z"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"
|
||||
},
|
||||
{
|
||||
"url": "https://issues.chromium.org/issues/574035865"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126904",
|
||||
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Chrome",
|
||||
"dateReserved": "2026-11-11T22:10:49.218Z",
|
||||
"datePublished": "2026-11-11T22:38:54.096Z",
|
||||
"dateUpdated": "2026-11-11T22:38:54.096Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Google",
|
||||
"product": "Chrome",
|
||||
"versions": [
|
||||
{
|
||||
"version": "157.0.8103.78",
|
||||
"status": "affected",
|
||||
"lessThan": "157.0.8103.78",
|
||||
"versionType": "custom"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Use after free in Compositing in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Use after free",
|
||||
"cweId": "CWE-416"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"shortName": "Chrome",
|
||||
"dateUpdated": "2026-11-11T22:38:54.096Z"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"
|
||||
},
|
||||
{
|
||||
"url": "https://issues.chromium.org/issues/574410140"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126905",
|
||||
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Chrome",
|
||||
"dateReserved": "2026-11-11T22:10:51.618Z",
|
||||
"datePublished": "2026-11-11T22:38:58.975Z",
|
||||
"dateUpdated": "2026-11-11T22:38:58.975Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Google",
|
||||
"product": "Chrome",
|
||||
"versions": [
|
||||
{
|
||||
"version": "157.0.8103.78",
|
||||
"status": "affected",
|
||||
"lessThan": "157.0.8103.78",
|
||||
"versionType": "custom"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Incomplete cleanup in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Incomplete cleanup",
|
||||
"cweId": "CWE-459"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"shortName": "Chrome",
|
||||
"dateUpdated": "2026-11-11T22:38:58.975Z"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"
|
||||
},
|
||||
{
|
||||
"url": "https://issues.chromium.org/issues/577305517"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126906",
|
||||
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Chrome",
|
||||
"dateReserved": "2026-11-11T22:10:53.113Z",
|
||||
"datePublished": "2026-11-11T22:39:03.140Z",
|
||||
"dateUpdated": "2026-11-11T22:39:03.140Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Google",
|
||||
"product": "Chrome",
|
||||
"versions": [
|
||||
{
|
||||
"version": "157.0.8103.78",
|
||||
"status": "affected",
|
||||
"lessThan": "157.0.8103.78",
|
||||
"versionType": "custom"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Race condition in Extensions in Google Chrome on on Mac prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via crafted network traffic. (Chromium security severity: High)"
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Race condition",
|
||||
"cweId": "CWE-367"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"shortName": "Chrome",
|
||||
"dateUpdated": "2026-11-11T22:39:03.140Z"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"
|
||||
},
|
||||
{
|
||||
"url": "https://issues.chromium.org/issues/578693038"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126907",
|
||||
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Chrome",
|
||||
"dateReserved": "2026-11-11T22:10:55.448Z",
|
||||
"datePublished": "2026-11-11T22:38:54.279Z",
|
||||
"dateUpdated": "2026-11-11T22:38:54.279Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Google",
|
||||
"product": "Chrome",
|
||||
"versions": [
|
||||
{
|
||||
"version": "157.0.8103.78",
|
||||
"status": "affected",
|
||||
"lessThan": "157.0.8103.78",
|
||||
"versionType": "custom"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Uninitialized resource in Media in Google Chrome on on Windows prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to potentially read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)"
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Uninitialized resource",
|
||||
"cweId": "CWE-908"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"shortName": "Chrome",
|
||||
"dateUpdated": "2026-11-11T22:38:54.279Z"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"
|
||||
},
|
||||
{
|
||||
"url": "https://issues.chromium.org/issues/574791611"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126908",
|
||||
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Chrome",
|
||||
"dateReserved": "2026-11-11T22:10:57.634Z",
|
||||
"datePublished": "2026-11-11T22:39:04.238Z",
|
||||
"dateUpdated": "2026-11-11T22:39:04.238Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Google",
|
||||
"product": "Chrome",
|
||||
"versions": [
|
||||
{
|
||||
"version": "157.0.8103.78",
|
||||
"status": "affected",
|
||||
"lessThan": "157.0.8103.78",
|
||||
"versionType": "custom"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Type confusion in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Type confusion",
|
||||
"cweId": "CWE-843"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"shortName": "Chrome",
|
||||
"dateUpdated": "2026-11-11T22:39:04.238Z"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"
|
||||
},
|
||||
{
|
||||
"url": "https://issues.chromium.org/issues/579313083"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126909",
|
||||
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Chrome",
|
||||
"dateReserved": "2026-11-11T22:11:04.161Z",
|
||||
"datePublished": "2026-11-11T22:38:51.676Z",
|
||||
"dateUpdated": "2026-11-11T22:38:51.676Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Google",
|
||||
"product": "Chrome",
|
||||
"versions": [
|
||||
{
|
||||
"version": "157.0.8103.78",
|
||||
"status": "affected",
|
||||
"lessThan": "157.0.8103.78",
|
||||
"versionType": "custom"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Use after free in Passwords in Google Chrome prior to 157.0.8103.78 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Use after free",
|
||||
"cweId": "CWE-416"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"shortName": "Chrome",
|
||||
"dateUpdated": "2026-11-11T22:38:51.676Z"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"
|
||||
},
|
||||
{
|
||||
"url": "https://issues.chromium.org/issues/572501958"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126910",
|
||||
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Chrome",
|
||||
"dateReserved": "2026-11-11T22:11:08.099Z",
|
||||
"datePublished": "2026-11-11T22:38:52.770Z",
|
||||
"dateUpdated": "2026-11-11T22:38:52.770Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Google",
|
||||
"product": "Chrome",
|
||||
"versions": [
|
||||
{
|
||||
"version": "157.0.8103.78",
|
||||
"status": "affected",
|
||||
"lessThan": "157.0.8103.78",
|
||||
"versionType": "custom"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Type confusion in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Type confusion",
|
||||
"cweId": "CWE-843"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"shortName": "Chrome",
|
||||
"dateUpdated": "2026-11-11T22:38:52.770Z"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"
|
||||
},
|
||||
{
|
||||
"url": "https://issues.chromium.org/issues/574059463"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126911",
|
||||
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Chrome",
|
||||
"dateReserved": "2026-11-11T22:11:11.667Z",
|
||||
"datePublished": "2026-11-11T22:38:49.757Z",
|
||||
"dateUpdated": "2026-11-11T22:38:49.757Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Google",
|
||||
"product": "Chrome",
|
||||
"versions": [
|
||||
{
|
||||
"version": "157.0.8103.78",
|
||||
"status": "affected",
|
||||
"lessThan": "157.0.8103.78",
|
||||
"versionType": "custom"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Use after free in Accessibility in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Use after free",
|
||||
"cweId": "CWE-416"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"shortName": "Chrome",
|
||||
"dateUpdated": "2026-11-11T22:38:49.757Z"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"
|
||||
},
|
||||
{
|
||||
"url": "https://issues.chromium.org/issues/580921803"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126912",
|
||||
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Chrome",
|
||||
"dateReserved": "2026-11-11T22:11:15.617Z",
|
||||
"datePublished": "2026-11-11T22:38:51.126Z",
|
||||
"dateUpdated": "2026-11-11T22:38:51.126Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Google",
|
||||
"product": "Chrome",
|
||||
"versions": [
|
||||
{
|
||||
"version": "157.0.8103.78",
|
||||
"status": "affected",
|
||||
"lessThan": "157.0.8103.78",
|
||||
"versionType": "custom"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Buffer overflow in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Buffer overflow",
|
||||
"cweId": "CWE-122"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"shortName": "Chrome",
|
||||
"dateUpdated": "2026-11-11T22:38:51.126Z"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"
|
||||
},
|
||||
{
|
||||
"url": "https://issues.chromium.org/issues/569286603"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126913",
|
||||
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Chrome",
|
||||
"dateReserved": "2026-11-11T22:11:18.100Z",
|
||||
"datePublished": "2026-11-11T22:39:05.958Z",
|
||||
"dateUpdated": "2026-11-11T22:39:05.958Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Google",
|
||||
"product": "Chrome",
|
||||
"versions": [
|
||||
{
|
||||
"version": "157.0.8103.78",
|
||||
"status": "affected",
|
||||
"lessThan": "157.0.8103.78",
|
||||
"versionType": "custom"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Out of bounds read in Compositing in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)"
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Out of bounds read",
|
||||
"cweId": "CWE-125"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"shortName": "Chrome",
|
||||
"dateUpdated": "2026-11-11T22:39:05.958Z"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"
|
||||
},
|
||||
{
|
||||
"url": "https://issues.chromium.org/issues/580875215"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126914",
|
||||
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Chrome",
|
||||
"dateReserved": "2026-11-11T22:11:20.380Z",
|
||||
"datePublished": "2026-11-11T22:38:59.534Z",
|
||||
"dateUpdated": "2026-11-11T22:38:59.534Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Google",
|
||||
"product": "Chrome",
|
||||
"versions": [
|
||||
{
|
||||
"version": "157.0.8103.78",
|
||||
"status": "affected",
|
||||
"lessThan": "157.0.8103.78",
|
||||
"versionType": "custom"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Uninitialized resource in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)"
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Uninitialized resource",
|
||||
"cweId": "CWE-908"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"shortName": "Chrome",
|
||||
"dateUpdated": "2026-11-11T22:38:59.534Z"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"
|
||||
},
|
||||
{
|
||||
"url": "https://issues.chromium.org/issues/577346516"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126915",
|
||||
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Chrome",
|
||||
"dateReserved": "2026-11-11T22:11:22.132Z",
|
||||
"datePublished": "2026-11-11T22:39:03.463Z",
|
||||
"dateUpdated": "2026-11-11T22:39:03.463Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Google",
|
||||
"product": "Chrome",
|
||||
"versions": [
|
||||
{
|
||||
"version": "157.0.8103.78",
|
||||
"status": "affected",
|
||||
"lessThan": "157.0.8103.78",
|
||||
"versionType": "custom"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Use of uninitialized variable in Skia in Google Chrome on on Android prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Use of uninitialized variable",
|
||||
"cweId": "CWE-457"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"shortName": "Chrome",
|
||||
"dateUpdated": "2026-11-11T22:39:03.463Z"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"
|
||||
},
|
||||
{
|
||||
"url": "https://issues.chromium.org/issues/579276256"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126916",
|
||||
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Chrome",
|
||||
"dateReserved": "2026-11-11T22:11:26.019Z",
|
||||
"datePublished": "2026-11-11T22:38:52.403Z",
|
||||
"dateUpdated": "2026-11-11T22:38:52.403Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Google",
|
||||
"product": "Chrome",
|
||||
"versions": [
|
||||
{
|
||||
"version": "157.0.8103.78",
|
||||
"status": "affected",
|
||||
"lessThan": "157.0.8103.78",
|
||||
"versionType": "custom"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Integer overflow in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Integer overflow",
|
||||
"cweId": "CWE-190"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"shortName": "Chrome",
|
||||
"dateUpdated": "2026-11-11T22:38:52.403Z"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"
|
||||
},
|
||||
{
|
||||
"url": "https://issues.chromium.org/issues/574025697"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126917",
|
||||
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Chrome",
|
||||
"dateReserved": "2026-11-11T22:11:27.749Z",
|
||||
"datePublished": "2026-11-11T22:38:58.563Z",
|
||||
"dateUpdated": "2026-11-11T22:38:58.563Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Google",
|
||||
"product": "Chrome",
|
||||
"versions": [
|
||||
{
|
||||
"version": "157.0.8103.78",
|
||||
"status": "affected",
|
||||
"lessThan": "157.0.8103.78",
|
||||
"versionType": "custom"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Memory corruption in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Memory corruption",
|
||||
"cweId": "CWE-119"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"shortName": "Chrome",
|
||||
"dateUpdated": "2026-11-11T22:38:58.563Z"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"
|
||||
},
|
||||
{
|
||||
"url": "https://issues.chromium.org/issues/577242082"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126918",
|
||||
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Chrome",
|
||||
"dateReserved": "2026-11-11T22:11:31.020Z",
|
||||
"datePublished": "2026-11-11T22:38:56.649Z",
|
||||
"dateUpdated": "2026-11-11T22:38:56.649Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Google",
|
||||
"product": "Chrome",
|
||||
"versions": [
|
||||
{
|
||||
"version": "157.0.8103.78",
|
||||
"status": "affected",
|
||||
"lessThan": "157.0.8103.78",
|
||||
"versionType": "custom"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Use after free in Layout in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Use after free",
|
||||
"cweId": "CWE-416"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"shortName": "Chrome",
|
||||
"dateUpdated": "2026-11-11T22:38:56.649Z"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"
|
||||
},
|
||||
{
|
||||
"url": "https://issues.chromium.org/issues/576855527"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126919",
|
||||
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Chrome",
|
||||
"dateReserved": "2026-11-11T22:11:34.588Z",
|
||||
"datePublished": "2026-11-11T22:38:51.305Z",
|
||||
"dateUpdated": "2026-11-11T22:38:51.305Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Google",
|
||||
"product": "Chrome",
|
||||
"versions": [
|
||||
{
|
||||
"version": "157.0.8103.78",
|
||||
"status": "affected",
|
||||
"lessThan": "157.0.8103.78",
|
||||
"versionType": "custom"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Use after free in BrowserTag in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Use after free",
|
||||
"cweId": "CWE-416"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"shortName": "Chrome",
|
||||
"dateUpdated": "2026-11-11T22:38:51.305Z"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"
|
||||
},
|
||||
{
|
||||
"url": "https://issues.chromium.org/issues/569674220"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126920",
|
||||
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Chrome",
|
||||
"dateReserved": "2026-11-11T22:11:36.691Z",
|
||||
"datePublished": "2026-11-11T22:39:06.670Z",
|
||||
"dateUpdated": "2026-11-11T22:39:06.670Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Google",
|
||||
"product": "Chrome",
|
||||
"versions": [
|
||||
{
|
||||
"version": "157.0.8103.78",
|
||||
"status": "affected",
|
||||
"lessThan": "157.0.8103.78",
|
||||
"versionType": "custom"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Information leak in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)"
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Information leak",
|
||||
"cweId": "CWE-200"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"shortName": "Chrome",
|
||||
"dateUpdated": "2026-11-11T22:39:06.670Z"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"
|
||||
},
|
||||
{
|
||||
"url": "https://issues.chromium.org/issues/581903854"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126921",
|
||||
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Chrome",
|
||||
"dateReserved": "2026-11-11T22:11:39.141Z",
|
||||
"datePublished": "2026-11-11T22:39:05.767Z",
|
||||
"dateUpdated": "2026-11-11T22:39:05.767Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Google",
|
||||
"product": "Chrome",
|
||||
"versions": [
|
||||
{
|
||||
"version": "157.0.8103.78",
|
||||
"status": "affected",
|
||||
"lessThan": "157.0.8103.78",
|
||||
"versionType": "custom"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Use after free in Accessibility in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Use after free",
|
||||
"cweId": "CWE-416"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"shortName": "Chrome",
|
||||
"dateUpdated": "2026-11-11T22:39:05.767Z"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"
|
||||
},
|
||||
{
|
||||
"url": "https://issues.chromium.org/issues/580869107"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126922",
|
||||
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Chrome",
|
||||
"dateReserved": "2026-11-11T22:11:41.059Z",
|
||||
"datePublished": "2026-11-11T22:38:59.338Z",
|
||||
"dateUpdated": "2026-11-11T22:38:59.338Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Google",
|
||||
"product": "Chrome",
|
||||
"versions": [
|
||||
{
|
||||
"version": "157.0.8103.78",
|
||||
"status": "affected",
|
||||
"lessThan": "157.0.8103.78",
|
||||
"versionType": "custom"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Out of bounds read in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)"
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Out of bounds read",
|
||||
"cweId": "CWE-125"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
|
||||
"shortName": "Chrome",
|
||||
"dateUpdated": "2026-11-11T22:38:59.338Z"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"
|
||||
},
|
||||
{
|
||||
"url": "https://issues.chromium.org/issues/577341943"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,142 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126932",
|
||||
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "VulnCheck",
|
||||
"dateReserved": "2026-11-11T22:45:25.171Z",
|
||||
"datePublished": "2026-11-11T22:53:18.142Z",
|
||||
"dateUpdated": "2026-11-11T22:53:18.142Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"providerMetadata": {
|
||||
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
|
||||
"shortName": "VulnCheck",
|
||||
"dateUpdated": "2026-11-11T22:53:18.142Z"
|
||||
},
|
||||
"datePublic": "2026-09-27T00:00:00.000Z",
|
||||
"title": "Zipline 4.6.2 before 4.8.0 Disabled MIME Type Policy Bypass via File Metadata Update",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Zipline 4.6.2 before 4.8.0 contains a policy bypass vulnerability that allows authenticated users to evade administrator-disabled MIME types by editing file metadata. Attackers can upload a permitted file, then set a disabled type such as text/html through PATCH /api/user/files/:id so /raw/:id serves that Content-Type."
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Unrestricted Upload of File with Dangerous Type",
|
||||
"cweId": "CWE-434",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "diced",
|
||||
"product": "zipline",
|
||||
"defaultStatus": "unaffected",
|
||||
"packageURL": "pkg:github/diced/zipline",
|
||||
"versions": [
|
||||
{
|
||||
"version": "4.6.2",
|
||||
"lessThan": "4.8.0",
|
||||
"status": "affected",
|
||||
"versionType": "semver"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"format": "CVSS",
|
||||
"cvssV4_0": {
|
||||
"version": "4.0",
|
||||
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"attackRequirements": "NONE",
|
||||
"privilegesRequired": "LOW",
|
||||
"userInteraction": "NONE",
|
||||
"vulnConfidentialityImpact": "NONE",
|
||||
"vulnIntegrityImpact": "LOW",
|
||||
"vulnAvailabilityImpact": "NONE",
|
||||
"subConfidentialityImpact": "NONE",
|
||||
"subIntegrityImpact": "NONE",
|
||||
"subAvailabilityImpact": "NONE",
|
||||
"baseScore": 5.3,
|
||||
"baseSeverity": "MEDIUM"
|
||||
}
|
||||
},
|
||||
{
|
||||
"format": "CVSS",
|
||||
"cvssV3_1": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "LOW",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "NONE",
|
||||
"integrityImpact": "LOW",
|
||||
"availabilityImpact": "NONE",
|
||||
"baseScore": 4.3,
|
||||
"baseSeverity": "MEDIUM"
|
||||
}
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://github.com/diced/zipline/security/advisories/GHSA-rgxm-54cf-whf7",
|
||||
"tags": [
|
||||
"vendor-advisory"
|
||||
],
|
||||
"name": "GitHub Security Advisory (GHSA-rgxm-54cf-whf7)"
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/diced/zipline/commit/fc8e886ca841b86a3f677cd7dac1bf9a5bd45b2c",
|
||||
"tags": [
|
||||
"patch"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/diced/zipline/releases/tag/v4.8.0",
|
||||
"tags": [
|
||||
"release-notes"
|
||||
],
|
||||
"name": "zipline v4.8.0 Release Notes"
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/diced/zipline/blob/v4.7.0/src/server/routes/api/user/files/%5Bid%5D/index.ts#L96",
|
||||
"tags": [
|
||||
"technical-description"
|
||||
]
|
||||
},
|
||||
{
|
||||
"name": "VulnCheck Advisory: Zipline 4.6.2 before 4.8.0 Disabled MIME Type Policy Bypass via File Metadata Update",
|
||||
"tags": [
|
||||
"third-party-advisory"
|
||||
],
|
||||
"url": "https://www.vulncheck.com/advisories/zipline-4.6.2-before-4.8.0-disabled-mime-type-policy-bypass-via-file-metadata-update"
|
||||
}
|
||||
],
|
||||
"credits": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Sandipkumar sah",
|
||||
"type": "finder"
|
||||
}
|
||||
],
|
||||
"x_generator": {
|
||||
"engine": "vulncheck-endgame"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,148 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126933",
|
||||
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "VulnCheck",
|
||||
"dateReserved": "2026-11-11T22:45:25.520Z",
|
||||
"datePublished": "2026-11-11T22:53:18.764Z",
|
||||
"dateUpdated": "2026-11-11T22:53:18.764Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"providerMetadata": {
|
||||
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
|
||||
"shortName": "VulnCheck",
|
||||
"dateUpdated": "2026-11-11T22:53:18.764Z"
|
||||
},
|
||||
"datePublic": "2026-09-27T00:00:00.000Z",
|
||||
"title": "Zipline 4.0.0 before 4.8.0 Disabled Extensions Upload Filter Bypass via Extension Format Mismatch",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Zipline 4.0.0 before 4.8.0 contains an upload filter bypass vulnerability that allows users with upload access to store blocked file types due to extension format mismatch. The upload and partial handlers compare dotted, case-sensitive extensions against undotted disabledExtensions entries, letting authenticated or permitted unauthenticated folder uploaders bypass administrator restrictions."
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Incomplete List of Disallowed Inputs",
|
||||
"cweId": "CWE-184",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "diced",
|
||||
"product": "zipline",
|
||||
"defaultStatus": "unaffected",
|
||||
"packageURL": "pkg:github/diced/zipline",
|
||||
"versions": [
|
||||
{
|
||||
"version": "4.0.0",
|
||||
"lessThan": "4.8.0",
|
||||
"status": "affected",
|
||||
"versionType": "semver"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"format": "CVSS",
|
||||
"cvssV4_0": {
|
||||
"version": "4.0",
|
||||
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"attackRequirements": "NONE",
|
||||
"privilegesRequired": "LOW",
|
||||
"userInteraction": "NONE",
|
||||
"vulnConfidentialityImpact": "NONE",
|
||||
"vulnIntegrityImpact": "LOW",
|
||||
"vulnAvailabilityImpact": "NONE",
|
||||
"subConfidentialityImpact": "NONE",
|
||||
"subIntegrityImpact": "NONE",
|
||||
"subAvailabilityImpact": "NONE",
|
||||
"baseScore": 5.3,
|
||||
"baseSeverity": "MEDIUM"
|
||||
}
|
||||
},
|
||||
{
|
||||
"format": "CVSS",
|
||||
"cvssV3_1": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "LOW",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "NONE",
|
||||
"integrityImpact": "LOW",
|
||||
"availabilityImpact": "NONE",
|
||||
"baseScore": 4.3,
|
||||
"baseSeverity": "MEDIUM"
|
||||
}
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://github.com/diced/zipline/security/advisories/GHSA-wwrw-gq56-7wpj",
|
||||
"tags": [
|
||||
"vendor-advisory"
|
||||
],
|
||||
"name": "GitHub Security Advisory (GHSA-wwrw-gq56-7wpj)"
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/diced/zipline/commit/dbc1fe502130a8ebd95fa04886efec01402e5b5f",
|
||||
"tags": [
|
||||
"patch"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/diced/zipline/releases/tag/v4.8.0",
|
||||
"tags": [
|
||||
"release-notes"
|
||||
],
|
||||
"name": "zipline v4.8.0 Release Notes"
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/diced/zipline/blob/v4.7.0/src/server/routes/api/upload/index.ts#L170",
|
||||
"tags": [
|
||||
"technical-description"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/diced/zipline/blob/v4.7.0/src/server/routes/api/upload/partial.ts#L294",
|
||||
"tags": [
|
||||
"technical-description"
|
||||
]
|
||||
},
|
||||
{
|
||||
"name": "VulnCheck Advisory: Zipline 4.0.0 before 4.8.0 Disabled Extensions Upload Filter Bypass via Extension Format Mismatch",
|
||||
"tags": [
|
||||
"third-party-advisory"
|
||||
],
|
||||
"url": "https://www.vulncheck.com/advisories/zipline-4.0.0-before-4.8.0-disabled-extensions-upload-filter-bypass-via-extension-format-mismatch"
|
||||
}
|
||||
],
|
||||
"credits": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Sandipkumar sah",
|
||||
"type": "finder"
|
||||
}
|
||||
],
|
||||
"x_generator": {
|
||||
"engine": "vulncheck-endgame"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,148 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126934",
|
||||
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "VulnCheck",
|
||||
"dateReserved": "2026-11-11T22:45:25.863Z",
|
||||
"datePublished": "2026-11-11T22:53:19.421Z",
|
||||
"dateUpdated": "2026-11-11T22:53:19.421Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"providerMetadata": {
|
||||
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
|
||||
"shortName": "VulnCheck",
|
||||
"dateUpdated": "2026-11-11T22:53:19.421Z"
|
||||
},
|
||||
"datePublic": "2026-09-27T00:00:00.000Z",
|
||||
"title": "Zipline 4.3.2 before 4.8.0 Rate Limit Bypass via Spoofed X-Forwarded-For",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Zipline 4.3.2 before 4.8.0 contains a rate limit bypass vulnerability that allows unauthenticated attackers to evade throttling by spoofing X-Forwarded-For headers when core.trustProxy is enabled. Attackers can send a different X-Forwarded-For value per request to obtain fresh rate-limit buckets, enabling unlimited guessing of login passwords, TOTP codes, and file and URL passwords."
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Use of Less Trusted Source",
|
||||
"cweId": "CWE-348",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "diced",
|
||||
"product": "zipline",
|
||||
"defaultStatus": "unaffected",
|
||||
"packageURL": "pkg:github/diced/zipline",
|
||||
"versions": [
|
||||
{
|
||||
"version": "4.3.2",
|
||||
"lessThan": "4.8.0",
|
||||
"status": "affected",
|
||||
"versionType": "semver"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"format": "CVSS",
|
||||
"cvssV4_0": {
|
||||
"version": "4.0",
|
||||
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"attackRequirements": "NONE",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "NONE",
|
||||
"vulnConfidentialityImpact": "LOW",
|
||||
"vulnIntegrityImpact": "LOW",
|
||||
"vulnAvailabilityImpact": "NONE",
|
||||
"subConfidentialityImpact": "NONE",
|
||||
"subIntegrityImpact": "NONE",
|
||||
"subAvailabilityImpact": "NONE",
|
||||
"baseScore": 6.9,
|
||||
"baseSeverity": "MEDIUM"
|
||||
}
|
||||
},
|
||||
{
|
||||
"format": "CVSS",
|
||||
"cvssV3_1": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "LOW",
|
||||
"integrityImpact": "LOW",
|
||||
"availabilityImpact": "NONE",
|
||||
"baseScore": 6.5,
|
||||
"baseSeverity": "MEDIUM"
|
||||
}
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://github.com/diced/zipline/security/advisories/GHSA-v938-v8wg-9497",
|
||||
"tags": [
|
||||
"vendor-advisory"
|
||||
],
|
||||
"name": "GitHub Security Advisory (GHSA-v938-v8wg-9497)"
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/diced/zipline/commit/6bac7e6bb18cb37c1d09f91306c1ffbdca00097c",
|
||||
"tags": [
|
||||
"patch"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/diced/zipline/releases/tag/v4.8.0",
|
||||
"tags": [
|
||||
"release-notes"
|
||||
],
|
||||
"name": "zipline v4.8.0 Release Notes"
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/diced/zipline/blob/v4.7.0/src/server/index.ts#L58-L62",
|
||||
"tags": [
|
||||
"technical-description"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/diced/zipline/blob/v4.7.0/src/server/startup/plugins.ts#L70-L73",
|
||||
"tags": [
|
||||
"technical-description"
|
||||
]
|
||||
},
|
||||
{
|
||||
"name": "VulnCheck Advisory: Zipline 4.3.2 before 4.8.0 Rate Limit Bypass via Spoofed X-Forwarded-For",
|
||||
"tags": [
|
||||
"third-party-advisory"
|
||||
],
|
||||
"url": "https://www.vulncheck.com/advisories/zipline-4.3.2-before-4.8.0-rate-limit-bypass-via-spoofed-x-forwarded-for"
|
||||
}
|
||||
],
|
||||
"credits": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Sandipkumar sah",
|
||||
"type": "finder"
|
||||
}
|
||||
],
|
||||
"x_generator": {
|
||||
"engine": "vulncheck-endgame"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,142 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126935",
|
||||
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "VulnCheck",
|
||||
"dateReserved": "2026-11-11T22:45:26.204Z",
|
||||
"datePublished": "2026-11-11T22:53:20.141Z",
|
||||
"dateUpdated": "2026-11-11T22:53:20.141Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"providerMetadata": {
|
||||
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
|
||||
"shortName": "VulnCheck",
|
||||
"dateUpdated": "2026-11-11T22:53:20.141Z"
|
||||
},
|
||||
"datePublic": "2026-09-27T00:00:00.000Z",
|
||||
"title": "Zipline before 4.8.0 maxViews Limit Bypass via Race Condition",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Zipline before 4.8.0 contains a race condition vulnerability in src/server/routes/raw/[id].ts that allows remote attackers to bypass file maxViews limits through non-atomic view counting. Attackers holding a file link can send parallel requests that read the same pre-increment count, viewing view-limited or delete-on-max-views files beyond their limit."
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Time-of-check Time-of-use (TOCTOU) Race Condition",
|
||||
"cweId": "CWE-367",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "diced",
|
||||
"product": "zipline",
|
||||
"defaultStatus": "unaffected",
|
||||
"packageURL": "pkg:github/diced/zipline",
|
||||
"versions": [
|
||||
{
|
||||
"version": "0",
|
||||
"lessThan": "4.8.0",
|
||||
"status": "affected",
|
||||
"versionType": "semver"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"format": "CVSS",
|
||||
"cvssV4_0": {
|
||||
"version": "4.0",
|
||||
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"attackRequirements": "PRESENT",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "NONE",
|
||||
"vulnConfidentialityImpact": "LOW",
|
||||
"vulnIntegrityImpact": "NONE",
|
||||
"vulnAvailabilityImpact": "NONE",
|
||||
"subConfidentialityImpact": "NONE",
|
||||
"subIntegrityImpact": "NONE",
|
||||
"subAvailabilityImpact": "NONE",
|
||||
"baseScore": 6.3,
|
||||
"baseSeverity": "MEDIUM"
|
||||
}
|
||||
},
|
||||
{
|
||||
"format": "CVSS",
|
||||
"cvssV3_1": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "HIGH",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "LOW",
|
||||
"integrityImpact": "NONE",
|
||||
"availabilityImpact": "NONE",
|
||||
"baseScore": 3.7,
|
||||
"baseSeverity": "LOW"
|
||||
}
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://github.com/diced/zipline/security/advisories/GHSA-7xv9-wr46-j578",
|
||||
"tags": [
|
||||
"vendor-advisory"
|
||||
],
|
||||
"name": "GitHub Security Advisory (GHSA-7xv9-wr46-j578)"
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/diced/zipline/commit/1770479d6795ea8700f0ce6ba08a1654d3644c73",
|
||||
"tags": [
|
||||
"patch"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/diced/zipline/releases/tag/v4.8.0",
|
||||
"tags": [
|
||||
"release-notes"
|
||||
],
|
||||
"name": "zipline v4.8.0 Release Notes"
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/diced/zipline/blob/v4.7.0/src/server/routes/raw/%5Bid%5D.ts#L101-L133",
|
||||
"tags": [
|
||||
"technical-description"
|
||||
]
|
||||
},
|
||||
{
|
||||
"name": "VulnCheck Advisory: Zipline before 4.8.0 maxViews Limit Bypass via Race Condition",
|
||||
"tags": [
|
||||
"third-party-advisory"
|
||||
],
|
||||
"url": "https://www.vulncheck.com/advisories/zipline-before-4.8.0-maxviews-limit-bypass-via-race-condition"
|
||||
}
|
||||
],
|
||||
"credits": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Sandipkumar sah",
|
||||
"type": "finder"
|
||||
}
|
||||
],
|
||||
"x_generator": {
|
||||
"engine": "vulncheck-endgame"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "redhat",
|
||||
"dateReserved": "2026-05-04T18:07:21.843Z",
|
||||
"datePublished": "2026-08-19T14:06:09.120Z",
|
||||
"dateUpdated": "2026-11-11T05:55:43.046Z"
|
||||
"dateUpdated": "2026-11-11T22:35:02.468Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -62,6 +62,24 @@
|
||||
],
|
||||
"defaultStatus": "unaffected"
|
||||
},
|
||||
{
|
||||
"vendor": "Red Hat",
|
||||
"product": "Red Hat Enterprise Linux 10.2 Extended Update Support",
|
||||
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
||||
"packageName": "vim",
|
||||
"defaultStatus": "affected",
|
||||
"versions": [
|
||||
{
|
||||
"version": "2:9.1.083-26.el10_2",
|
||||
"lessThan": "*",
|
||||
"versionType": "rpm",
|
||||
"status": "unaffected"
|
||||
}
|
||||
],
|
||||
"cpes": [
|
||||
"cpe:/o:redhat:enterprise_linux_eus:10.2"
|
||||
]
|
||||
},
|
||||
{
|
||||
"vendor": "Red Hat",
|
||||
"product": "Red Hat Enterprise Linux 8",
|
||||
@@ -216,6 +234,14 @@
|
||||
"x_refsource_REDHAT"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://access.redhat.com/errata/RHSA-2026:99165",
|
||||
"name": "RHSA-2026:99165",
|
||||
"tags": [
|
||||
"vendor-advisory",
|
||||
"x_refsource_REDHAT"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://access.redhat.com/security/cve/CVE-2026-43961",
|
||||
"tags": [
|
||||
@@ -276,7 +302,7 @@
|
||||
"providerMetadata": {
|
||||
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
|
||||
"shortName": "redhat",
|
||||
"dateUpdated": "2026-11-11T05:55:43.046Z"
|
||||
"dateUpdated": "2026-11-11T22:35:02.468Z"
|
||||
},
|
||||
"x_generator": {
|
||||
"engine": "cvelib 1.8.0"
|
||||
|
||||
+6
-12
@@ -1,18 +1,12 @@
|
||||
{
|
||||
"fetchTime": "2026-11-11T22:19:25.240Z",
|
||||
"numberOfChanges": 2,
|
||||
"fetchTime": "2026-11-11T23:18:11.669Z",
|
||||
"numberOfChanges": 1,
|
||||
"new": [
|
||||
{
|
||||
"cveId": "CVE-2026-107922",
|
||||
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-107922",
|
||||
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107922.json",
|
||||
"dateUpdated": "2026-11-11T22:18:59.410Z"
|
||||
},
|
||||
{
|
||||
"cveId": "CVE-2026-68549",
|
||||
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-68549",
|
||||
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/68xxx/CVE-2026-68549.json",
|
||||
"dateUpdated": "2026-11-11T22:14:50.340Z"
|
||||
"cveId": "CVE-2026-126759",
|
||||
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126759",
|
||||
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126759.json",
|
||||
"dateUpdated": "2026-11-11T23:15:22.210Z"
|
||||
}
|
||||
],
|
||||
"updated": [],
|
||||
|
||||
+626
-1027
File diff suppressed because it is too large
Load Diff
Reference in New Issue
Block a user