Base de CVEs

CVE-2026-106415 Média · 4.3 CWE-200 06/10/2026

Exposure of Sensitive Information em Google Chrome

Information leak in Enterprise in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-106392 Média · 4.3 CWE-200 06/10/2026

Exposure of Sensitive Information em Google Chrome

Information leak in WebAudio in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-106360 Média · 4.3 CWE-200 06/10/2026

Information leak in Payments in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to...

Information leak in Payments in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-106348 Média · 6.5 CWE-200 06/10/2026

Information leak in Animation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker...

Information leak in Animation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-106342 Alta · 8.8 CWE-200 06/10/2026

Information leak in Autofill in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to...

Information leak in Autofill in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-106334 Alta · 8.8 CWE-200 06/10/2026

Exposure of Sensitive Information em Google Chrome

Information leak in Payments in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-106330 Média · 4.3 CWE-200 06/10/2026

Exposure of Sensitive Information em Google Chrome

Information leak in Paint in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-106321 Média · 4.3 CWE-200 06/10/2026

Exposure of Sensitive Information em Google Chrome

Information leak in Editing in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to leak sensitive information via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-106277 Média · 4.3 CWE-200 06/10/2026

Exposure of Sensitive Information em Google Chrome

Information leak in Animation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-106256 Alta · 8.8 CWE-200 06/10/2026

Exposure of Sensitive Information em Google Chrome

Information leak in Passwords in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-106254 Média · 5.1 CWE-200 06/10/2026

Exposure of Sensitive Information em Google Chrome

Information leak in Mobile in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker to obtain sensitive information via a co-installed app. (Chromium security severity: Medium)

CVE-2026-106242 Média · 6.5 CWE-200 06/10/2026

Exposure of Sensitive Information em Google Chrome

Information leak in Omnibox in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to leak sensitive information via crafted network traffic. (Chromium security severity: Medium)

CVE-2026-106237 Crítica · 9.6 CWE-200 06/10/2026

Exposure of Sensitive Information em Google Chrome

Information leak in Permissions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-106220 Alta · 8.8 CWE-200 06/10/2026

Exposure of Sensitive Information em Google Chrome

Information leak in Passwords in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-106214 Média · 5.3 CWE-200 06/10/2026

Exposure of Sensitive Information em Google Chrome

Information leak in Proxy in Google Chrome on on Windows prior to 155.0.8059.39 allowed an adjacent attacker to obtain sensitive information via crafted network traffic. (Chromium security severity: High)

CVE-2026-106192 Média · 4.6 CWE-200 06/10/2026

Exposure of Sensitive Information em Google Chrome

Information leak in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a local attacker to obtain sensitive information via physical access. (Chromium security severity: Low)

CVE-2026-106120 Média · 6.0 CWE-200 06/10/2026

LiquidJS: ownPropertyOnly bypass for inherited array indices in first/last/join/reverse/slice/compact, `.first`/`.last`, negative index, and for-loop iteration

LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.27.2, enabling ownPropertyOnly does not consistently restrict inherited array indices because negative indexing, .first, .last, the first filter, the last filter, join, reverse, slice, compact, and for-loop iteration can read prototype-provided elements outside readJSProperty(). An attacker who can influence prototype state or inherited array-index data and cause templates to render affected operations can disclose values that ownPropertyOnly is expected to hide. Direct positive indexing and ordinary object prototype reads are blocked, but the alternate array paths remain affected. This issue is fixed in 10.27.2.

CVE-2026-95153 Média · 4.9 CWE-200 06/10/2026

An issue in Bludit CMS 3.22.0 allows a remote attacker to obtain sensitive information…

An issue in Bludit CMS 3.22.0 allows a remote attacker to obtain sensitive information via the /admin/ajax/clippy and /admin/ajax/save-as-draft endpoints

CVE-2026-105861 Alta · 8.2 CWE-200 06/10/2026

Payload external upload trust validation issue

Payload is a free and open source headless content management system. In versions after 3.0.0 and before 3.90.0, authenticated external URL-based upload retrieval can forward authentication data to a redirected destination that was not verified as trusted, potentially exposing a valid session to an unintended recipient. This issue is fixed in version 3.90.0.

CVE-2026-105853 Média · 6.5 CWE-200 06/10/2026

Payload: Token refresh and password reset responses may expose restricted user fields

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, token refresh responses and password reset responses can independently return hidden or read-restricted fields that the requesting user cannot access. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.

CVE-2026-105847 Média · 6.5 CWE-200 06/10/2026

Payload: Polymorphic join queries could disclose hidden fields

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, a user who can query a collection with a polymorphic join to sensitive fields can infer hidden or read-restricted values, including password-reset tokens, through polymorphic join filters. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.

CVE-2026-105805 Média · 6.9 CWE-200 06/10/2026

Payload: Sort queries could expose protected field information

Payload is a free and open source headless content management system. In versions before 3.88.0 and canary versions before 4.0.0-canary.27, an untrusted user who can query a readable collection, control its sorting, and select a protected field as the sort parameter can infer limited information about field values the user cannot read. This issue is fixed in versions 3.88.0 and 4.0.0-canary.27.

CVE-2026-86786 Média · 5.3 CWE-200 06/10/2026

Slider Pro <= 1.0.0 - Unauthenticated Sensitive Data Disclosure via sliderpro_multiple_images

The Slider Pro WordPress plugin through 1.0.0 does not perform any capability or authorisation check on one of its AJAX actions, allowing unauthenticated users to retrieve the title, excerpt and permalink of non-public posts, including drafts, pending, scheduled, private and trashed posts, as well as post revisions and media metadata.

CVE-2026-105707 Média · 5.3 CWE-200 06/10/2026

uptrace user_handler.go Login information exposure

A security vulnerability has been detected in uptrace up to 2.1.0-beta.8. Affected by this vulnerability is the function Login of the file pkg/org/user_handler.go. The manipulation leads to information exposure through error message. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CVE-2026-105752 Baixa · 3.1 CWE-200 05/10/2026

vLLM: Harmony tool continuations drop `cache_salt` — restoring a cross-tenant prefix-cache membership oracle

vLLM is an inference and serving engine for large language models. Prior to 0.30.0, Harmony tool continuations submitted through "POST /v1/responses" requests rebuild the next-turn engine input without preserving the cache_salt value, placing the continuation prefix in the global unsalted cache namespace even when the caller enabled salting. On deployments with prefix caching enabled, which is the default, an authenticated tenant who can reconstruct a victim's low-entropy post-tool history can submit the same continuation and use the cached_tokens_per_turn count to determine whether the prefix was previously processed, defeating the intended tenant isolation of salted prefix caching. This issue is fixed in version 0.30.0.