59.223 CVE seguite
803 Sfruttate ora
188 Usate dai ransomware
Ultima sincronia
CVE Tracker
59.223 CVE
Dieci fornitori seguiti per identificativo CPE, non per parola chiave: una CVE compare qui quando NVD dichiara quali prodotti tocca, di solito qualche giorno dopo la pubblicazione.
| Identificativo | Gravità, ordina dal più alto | Prodotto e difetto | EPSS, ordina dal più alto | In KEV dal, ordinato dal più alto |
|---|---|---|---|---|
| CVE-2026-87530 | HIGH 8.1 | google chrome Uncontrolled search path element in CredentialProvider in Google Chrome on on Windows prior to 153.0.8010.36 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. (Chromium security severity: Medium) | 0,1% | — |
| CVE-2026-87528 | CRIT 9.6 | google chrome Type confusion in Rust in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) | 0,5% | — |
| CVE-2026-87525 | LOW 2.7 | google chrome Out of bounds read in Chromoting in Google Chrome on on Windows prior to 153.0.8010.36 allowed a local attacker to read memory outside the sandbox via a local program. (Chromium security severity: High) | 0,1% | — |
| CVE-2026-87524 | HIGH 8.3 | google chrome Use after free in Core in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High | 0,4% | — |
| CVE-2026-87512 | CRIT 9.6 | google chrome Use after free in ANGLE in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) | 0,5% | — |
| CVE-2026-87509 | HIGH 8.1 | google chrome Incorrect authorization in Updater in Google Chrome on on Windows prior to 153.0.8010.36 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. (Chromium security severity: Low) | 0,1% | — |
| CVE-2026-87494 | CRIT 9.6 | google chrome Use after free in Browser in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) | 0,5% | — |
| CVE-2026-87467 | HIGH 8.1 | google chrome Race condition in Updater in Google Chrome on on Windows prior to 153.0.8010.36 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High) | 0,1% | — |
| CVE-2026-87457 | HIGH 8.1 | google chrome Race condition in Updater in Google Chrome on on Windows prior to 153.0.8010.36 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. (Chromium security severity: Medium) | 0,1% | — |
| CVE-2026-87454 | MED 6.5 | google chrome Information leak in Enterprise in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) | 0,3% | — |
| CVE-2026-87271 | HIGH 7.8 | oracle vm_virtualbox Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.16. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM V | 0,2% | — |
| CVE-2026-87270 | HIGH 7.8 | oracle vm_virtualbox Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.16. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM V | 0,2% | — |
| CVE-2026-87269 | HIGH 7.8 | oracle vm_virtualbox Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.16. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM V | 0,2% | — |
| CVE-2026-87268 | HIGH 7.8 | oracle vm_virtualbox Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.16. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM V | 0,2% | — |
| CVE-2026-8711 | HIGH 8.1 | f5 njs NGINX JavaScript has a vulnerability when the js_fetch_proxy directive is configured with at least one client-controlled NGINX variable (for example, $http_*, $arg_*, $cookie_*) and a location invoking the ngx.fetch() operation from NGINX JavaScript. An unauth | 0,8% | — |
| CVE-2026-86843 | MED 6.3 | apache apache-airflow-providers-teradata The Apache Airflow Teradata provider's compute-cluster example Dag declared every one of its Dag Params as unconstrained free text and templated them straight into the compute-cluster operators, which interpolate those values into Teradata DDL. A user who is p | 0,9% | — |
| CVE-2026-86792 | HIGH 8.8 | apache apache-airflow-providers-apache-kafka Apache Airflow Apache Kafka provider versions 1.15.0 before 2.0.0 resolve dotted-path strings found in a Kafka connection's `extra` field into Python callables via `import_string`, with no allowlist, and hand them to the confluent-kafka client which invokes th | 1,2% | — |
| CVE-2026-8673 | MED 5.9 | avantra avantra Unprotected transport of credentials vulnerability in syslink software AG Avantra on Linux, Windows allows Sniffing Attacks. This issue affects Avantra: before 25.3.0. | 0,3% | — |
| CVE-2026-8672 | MED 5.1 | avantra avantra Use of default password vulnerability in syslink software AG Avantra on Linux, Windows allows Try Common or Default Usernames and Passwords. This issue affects Avantra: before 25.3.0. | 0,1% | — |
| CVE-2026-8671 | HIGH 7.5 | avantra avantra Insertion of sensitive information into log file vulnerability in syslink software AG Avantra on Linux, Windows allows Resource Leak Exposure. This issue affects Avantra: before 25.3.0. | 0,4% | — |
| CVE-2026-8670 | CRIT 9.6 | avantra avantra Insufficient session expiration vulnerability in syslink software AG Avantra on Linux, Windows allows Reusing Session IDs (aka Session Replay). This issue affects Avantra: before 25.3.1. | 0,4% | — |
| CVE-2026-8666 | HIGH 7.7 | rapid7 insightconnect_traceroute OS Command Injection vulnerability in the traceroute action of Rapid7 InsightConnect Traceroute Plugin on Linux allows remote attackers to execute arbitrary OS commands via the host, port, max_ttl, count, or time_out request parameters due to insufficient inpu | 1,2% | — |
| CVE-2026-8665 | HIGH 7.7 | rapid7 insightconnect_translate OS Command Injection vulnerability in the TR action of Rapid7 InsightConnect Translate Plugin on Linux allows remote attackers to execute arbitrary OS commands via the text or expression parameters due to insufficient input sanitization in shell command constr | 1,2% | — |
| CVE-2026-8663 | MED 6.0 | rapid7 insightconnect_rpm OS Command Injection vulnerability in Rapid7 InsightConnect RPM Plugin on Linux allows authenticated attackers to execute arbitrary OS commands via the repo, key, or name parameters due to insufficient input sanitization in shell command construction. | 1,3% | — |
| CVE-2026-8662 | LOW 3.3 | rapid7 insightconnect_compression Path Traversal vulnerability in the create_archive function of Rapid7 InsightConnect Compression Plugin on Linux allows authenticated attackers to write to unintended file paths via crafted filename input. The impact is limited to file corruption as content ca | 0,3% | — |