CVE Vulnerability Catalog

Nieprawidłowy eksport komponentów aplikacji na Androida w SpriteWallpaper przed wydaniem SMR czerwiec-2026 Release 1 umożliwia lokalnym atakującym dostęp do wrażliwych informacji.

Błędne przypisanie uprawnień w Telephony przed wydaniem SMR Jun-2026 Release 1 umożliwia lokalnym atakującym dostęp do wrażliwych informacji.

Nieprawidłowe zarządzanie niewystarczającymi uprawnieniami w SecTelephonyProvider przed wydaniem SMR Jun-2026 Release 1 umożliwia lokalnym atakującym dostęp do plików z uprawnieniami.

HCL Digital Experience and HCL Digital Experience Compose are susceptible to Host header injection. An attacker can manipulate the Host header, causing the application to behave unexpectedly.

HCL Digital Experience Compose is affected by a reflected XSS vulnerability in the search center. An attacker could execute arbitrary JavaScript in the victim's browser.

The decompress package in all versions is vulnerable to arbitrary file write via archive extraction (Zip Slip). The vulnerability is due to microtask processing order that bypasses existing protections against writing through symlinks. An attacker can provide a crafted ZIP archive, potentially leading to remote code execution.

In Znuny LTS before 6.5.21 and Znuny before 7.3.3, there is reflected XSS in AdminCommunicationLog (communication log administration view).

Cross-Site Scripting (XSS) vulnerability in Znuny LTS before 6.5.21 and Znuny before 7.3.3 via stored user preferences.

In Mimecast Incydr before version 2.6.0, a vulnerability allows arbitrary file access.

OpenAI Atlas before version 1.2025.288.15 exposed privileged browser APIs to web content on *.openai.com origins. A cross-site scripting vulnerability in forum.openai.com could be used to access these functions, allowing access to browser history and the ability to open or close tabs.

In OpenStack Ironic versions 32 through 37.0.0, an unauthenticated user can submit a crafted JSON string to some API or JSON-RPC endpoints, causing a service crash.

Insufficient policy enforcement in History in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Severity: Low)

Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to perform privilege escalation via a crafted Chrome Extension. (Severity: Low)

Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to bypass discretionary access control via a crafted HTML page.

Inappropriate implementation in Permissions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Severity: Low)

In Google Chrome prior to version 149.0.7827.53, an integer overflow was found in the Fonts component. A remote attacker can use a crafted HTML page to obtain potentially sensitive information from process memory. (Severity: Low)

Inappropriate implementation in Chrome for iOS allows a remote attacker to bypass same origin policy via a crafted HTML page. The vulnerability affects versions prior to 149.0.7827.53.

Inappropriate implementation in Passwords in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Severity: Low)

Google Chrome prior to version 149.0.7827.53 has a vulnerability in Blink due to insufficient Content Security Policy enforcement. A remote attacker can bypass CSP via a crafted HTML page. (Severity: Low)

Inappropriate implementation in Android Autofill in Chrome on Android allows a remote attacker to bypass same origin policy via a crafted HTML page. The vulnerability affects versions prior to 149.0.7827.53.