CVE Database

CVE-2026-17775 Medium · 4.3 CWE-346 Jul 29, 2026

Inappropriate implementation in PresentationAPI in Google Chrome prior to 151.0.7922.72 allowed a...

Inappropriate implementation in PresentationAPI in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-17765 Medium · 4.3 CWE-346 Jul 29, 2026

Inappropriate implementation in WebProtect in Google Chrome prior to 151.0.7922.72 allowed a...

Inappropriate implementation in WebProtect in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-17763 Medium · 4.3 CWE-346 Jul 29, 2026

Inappropriate implementation in GPU in Google Chrome prior to 151.0.7922.72 allowed a remote...

Inappropriate implementation in GPU in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-17762 Medium · 4.3 CWE-346 Jul 29, 2026

Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72...

Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-17754 Medium · 6.5 CWE-346 Jul 29, 2026

Inappropriate implementation in Blink in Google Chrome prior to 151.0.7922.72 allowed a remote...

Inappropriate implementation in Blink in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-17753 Medium · 4.3 CWE-346 Jul 29, 2026

Inappropriate implementation in Autofill in Google Chrome prior to 151.0.7922.72 allowed a remote...

Inappropriate implementation in Autofill in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-17748 Medium · 6.5 CWE-346 Jul 29, 2026

Inappropriate implementation in Extensions in Google Chrome prior to 151.0.7922.72 allowed a...

Inappropriate implementation in Extensions in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-17743 Medium · 6.5 CWE-346 Jul 29, 2026

Insufficient policy enforcement in ControlledFrame in Google Chrome prior to 151.0.7922.72...

Insufficient policy enforcement in ControlledFrame in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-17742 Medium · 4.3 CWE-346 Jul 29, 2026

Insufficient policy enforcement in Payments in Google Chrome prior to 151.0.7922.72 allowed a...

Insufficient policy enforcement in Payments in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-17733 Medium · 4.3 CWE-346 Jul 29, 2026

Inappropriate implementation in QUIC in Google Chrome on Android prior to 151.0.7922.72 allowed a...

Inappropriate implementation in QUIC in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-17732 Low · 3.1 CWE-346 Jul 29, 2026

Inappropriate implementation in SVG in Google Chrome prior to 151.0.7922.72 allowed a remote...

Inappropriate implementation in SVG in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-17731 Medium · 4.3 CWE-346 Jul 29, 2026

Inappropriate implementation in Autofill in Google Chrome on Android prior to 151.0.7922.72...

Inappropriate implementation in Autofill in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-17720 Low · 3.1 CWE-346 Jul 29, 2026

Insufficient policy enforcement in Passwords in Google Chrome prior to 151.0.7922.72 allowed a...

Insufficient policy enforcement in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

CVE-2026-17715 Low · 3.1 CWE-346 Jul 29, 2026

Inappropriate implementation in Passwords in Google Chrome prior to 151.0.7922.72 allowed a...

Inappropriate implementation in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

CVE-2026-17702 Low · 3.1 CWE-346 Jul 29, 2026

Inappropriate implementation in Skia in Google Chrome prior to 151.0.7922.72 allowed a remote...

Inappropriate implementation in Skia in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

CVE-2026-17693 Medium · 4.3 CWE-346 Jul 29, 2026

Insufficient policy enforcement in FileSystem in Google Chrome prior to 151.0.7922.72 allowed a...

Insufficient policy enforcement in FileSystem in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

CVE-2026-17662 Medium · 4.3 CWE-346 Jul 29, 2026

Insufficient policy enforcement in Prefetch in Google Chrome prior to 151.0.7922.72 allowed a...

Insufficient policy enforcement in Prefetch in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

CVE-2026-6102 High · 7.8 CWE-346 Jul 29, 2026

MSI Center NTIOLib_X64 Origin Validation Error Local Privilege Escalation Vulnerability

MSI Center NTIOLib_X64 Origin Validation Error Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of MSI Center. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the NTIOLib_X64.sys driver. The issue results from insufficient validation of the origin of commands. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-28935.

CVE-2026-63118 Medium · 6.9 CWE-346 Jul 29, 2026

MCP Ruby SDK: Streamable HTTP transport lacks DNS-rebinding (Host/Origin) protection

MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in the mcp gem does not validate the HTTP Host or Origin request headers, which allows a malicious browser page to use DNS rebinding to reach a locally running MCP server and invoke exposed tools. This issue is fixed in version 0.23.0.

CVE-2026-57989 High · 7.4 CWE-346 Jul 26, 2026

Microsoft Edge (Chromium-based) Information Disclosure Vulnerability

Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.

CVE-2026-57978 Medium · 5.4 CWE-346 Jul 26, 2026

Microsoft Edge (Chromium-based) Spoofing Vulnerability

Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.

CVE-2026-16745 High · 8.8 CWE-346 Jul 23, 2026

Odh-dashboard: odh-dashboard: backend port 8080 trusts x-forwarded-access-token without origin validation

A flaw was found in odh-dashboard, the web console component of Red Hat OpenShift AI (RHOAI). Due to incorrect network binding, a malicious actor within the cluster can bypass authentication and impersonate any user by providing an arbitrary access token. This allows an attacker to gain unauthorized access to the Kubernetes API, potentially leading to arbitrary code execution, privilege escalation, or information disclosure.

CVE-2026-13321 High · 8.6 CWE-346 Jul 22, 2026

DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field

The BIND resolver accepts validly-signed NSEC records where the "Next Domain Name" field points outside the signer's zone. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.

CVE-2026-16399 High · 7.5 CWE-346 Jul 21, 2026

Site isolation issue in the DOM: Navigation component

Site isolation issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

CVE-2026-16381 Critical · 9.1 CWE-346 Jul 21, 2026

Same-origin policy bypass in the Networking: DNS component

Same-origin policy bypass in the Networking: DNS component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.