CVE-2026-16422
Insufficient validation of untrusted input in Certificate in Google Chrome on Linux prior to 150.0.7871.182 allowed an attacker in a privile
CVSS
—
No CVSS
EPSS
—
KEV
—
Exploit Today
0
0-100
Published: Jul 21, 2026 · Last modified: Jul 21, 2026 · CWE-20
Not enough EPSS history yet.
Insufficient validation of untrusted input in Certificate in Google Chrome on Linux prior to 150.0.7871.182 allowed an attacker in a privileged network position to perform domain spoofing via malicious network traffic. (Chromium security severity: High)
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-16415——
——0Insufficient validation of untrusted input in Extensions in Google Chrome prior to 150.0.7871.182 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: High)3hCVE-2026-16414——
——0Insufficient validation of untrusted input in Chromecast in Google Chrome prior to 150.0.7871.182 allowed a local attacker to potentially perform a sandbox escape via malicious network traffic. (Chromium security severity: High)3hCVE-2026-648778.4 HIG—
——0An authenticated non-admin user can exploit a SQL injection flaw in the ticketing REST API to access sensitive data stored in the appliance database.6hCVE-2026-15792——
——0A malicious BuildKit client or frontend could craft a request that could lead to BuildKit daemon crashing with a panic.8hCVE-2026-157248.7 HIG—
——0In Progress ShareFile Storage Zones Controller versions prior to 5.12.5 and 6.0.2, an authenticated administrative user can exploit a path traversal vulnerability to read arbitrary files from the server filesystem, write files to arbitrary directories, or determine whether specific files exist on the server.8hCVE-2026-17717.2 HIG44.2%
——13The MapSVG plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the SVGFile constructor in all versions up to, and including, 8.14.0 This is due to an incorrect conditional check that prevents file validation from taking place. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.9h