CVE Vulnerability Catalog

UI misrepresentation in Mobile in Google Chrome on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof address bar via a crafted HTML page.

Missing authorization in API in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to leak sensitive information via a crafted Chrome extension.

Improper input validation in Mobile in Google Chrome on iOS prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via crafted network traffic.

Uninitialized resource in ANGLE in Google Chrome on Windows prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page.

Information leak in Mobile in Google Chrome on iOS prior to 155.0.8059.39 allowed a local attacker to obtain sensitive information via physical access.

Missing authorization in Permissions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page.

Improper input validation in Viz in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page.

Uninitialized resource in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted HTML page.

Missing authorization in Chromoting in Google Chrome on Windows prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via crafted network traffic.

UI misrepresentation in Paint in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to spoof UI elements via a crafted HTML page.

Incorrect reference resolution in DevTools in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page.

UI misrepresentation in WebAppInstalls in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to spoof UI elements via a crafted HTML page.

The RabbitMQ Java client library prior to 5.35.0 includes the raw URI value in wrapped exceptions when AMQP URI parsing fails. Because the URI may contain a plaintext username and password, broker credentials can be disclosed through startup logs, monitoring systems, CI logs, and copied stack traces.

The RabbitMQ Java client library prior to 5.37.0 has a flaw in com.rabbitmq.tools.json.JSONReader.read() that fails to terminate when input ends inside a quoted string or line comment. The default DefaultJsonRpcMapper can then exhaust the heap or consume CPU indefinitely, resulting in denial of service.

LiquidJS prior to 10.27.2 does not consistently enforce ownPropertyOnly for inherited array indices, as negative indexing, .first, .last, first/last filters, join, reverse, slice, compact, and for-loop iteration can read prototype-provided elements outside readJSProperty(). An attacker able to influence prototype state can disclose values that ownPropertyOnly is expected to hide.

LangChain prior to 1.3.1 does not enforce the documented string type for an untrusted structured session identifier at runtime, allowing it to be interpreted as a MongoDB query condition rather than a literal value. An attacker able to invoke chat-history operations can read, modify, or delete another user's stored conversation when histories are stored in a shared MongoDB collection.

A DOM-based XSS vulnerability exists in the Ansible Platform UI due to unvalidated input handling in the redirect route. The application extracts a target from the next query parameter and assigns it directly to location.href, bypassing built-in URL validation and allowing arbitrary JavaScript execution in an authenticated user's session.

An authentication bypass in the OAuth device authorization flow in Devolutions Server 2026.3.7.0 and earlier allows a remote attacker to take over a user's account via replay of a captured device verification link by an authenticated victim.

TP-Link Tapo C500 v2.0 contains an out-of-bounds stack write vulnerability in its ONVIF PTZ SOAP handlers. An authenticated ONVIF client can submit an excessive number of preset-related elements, causing writes beyond fixed-size stack arrays and crashing the service.

Dell Command | Configure (DCC) versions prior to 5.2.3.35 contain a Use of Hard-coded Cryptographic Key vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to information disclosure.