CVE Watch2 jul 2026

CVE-2026-14118

Insufficient data validation in DevTools in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in

CVSS

6.5

Medio

EPSS

0.3%

p16

KEV

—

Exploit Today

0-100

Publicado: 30 jun 2026 · Última mod.: 2 jul 2026 · CWE-290 · CWE-20

EPSS · 30d

0.2%EPSS · 30 días0.3%

2026-07-012026-07-20

Descripción técnica

Insufficient data validation in DevTools in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-341978.8 ALT

99.9%

KEV—80Apache ActiveMQ Improper Input Validation Vulnerability6d CVE-2026-125699.8 CRÍ

66.0%

KEV—70PTC Windchill and FlexPLM Improper Input Validation Vulnerability20d CVE-2025-607877.2 ALT

97.0%

——29MotionEye v0.43.1b4 and before is vulnerable to OS Command Injection in configuration parameters such as image_file_name. Unsanitized user input is written to Motion configuration files, allowing remote authenticated attackers with admin access to achieve code execution when Motion is restarted.16d CVE-2018-53539.8 CRÍ

95.4%

——29The custom GINA/CP module in Zoho ManageEngine ADSelfService Plus before 5.5 build 5517 allows remote attackers to execute code and escalate privileges via spoofing. It does not authenticate the intended server before opening a browser window. An unauthenticated attacker capable of conducting a spoofing attack can redirect the browser to gain execution in the context of the WinLogon.exe process. If Network Level Authentication is not enforced, the vulnerability can be exploited via RDP. Additionally, if the web server has a misconfigured certificate then no spoofing attack is required12d CVE-2024-300877.8 ALT

94.9%

——28Win32k Elevation of Privilege Vulnerability10h CVE-2017-149197.5 ALT

94.3%

——28Node.js before 4.8.5, 6.x before 6.11.5, and 8.x before 8.8.0 allows remote attackers to cause a denial of service (uncaught exception and crash) by leveraging a change in the zlib module 1.2.9 making 8 an invalid value for the windowBits parameter.7d