Vulnerabilidades exploráveis hoje
17,581na visualização atual
Score único que combina CVSS, presença no KEV e EPSS. Cada CVE com sua própria ficha — timeline da publicação até a exploração ativa.
No catálogo KEV1,769
Novos KEV · 24H0
Exploit Today ≥ 701,700
Distribuição · última janela
- Crítica5,510
- Alta20,918
- Média20,003
- Baixa2,058
Filtros
Janela
Severidade
Filtros
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2026-1137277.4 ALT40.5%
——12OpenChoreo is a developer platform for Kubernetes. From 1.0.0 until 1.0.6, 1.1.7, and 1.2.5, the PUT .../workflowruns/{runName} update route authorizes a request using the openchoreo.dev/project and openchoreo.dev/component labels in the submitted body while selecting the stored WorkflowRun by the URL path. An authenticated caller with workflowrun:update for one project or component in the same namespace can name another run in the path, submit ownership labels for a scope they control, and rewrite the victim run's ownership labels. Subsequent authorization then treats the attacker as authorized to read build logs and Kubernetes events, delete the run, modify pending spec.workflow.parameters, or place the run into a permanent ComponentValidationFailed state. The namespace comes from the URL, so the issue is cross-project or cross-component within one namespace and is not anonymously reachable or cross-tenant. This issue is fixed in 1.0.6, 1.1.7, and 1.2.5.16dCVE-2026-1137267.8 ALT28.2%
——8virtualenv is a tool for creating isolated virtual python environments. Prior to 21.13.0, the bash activate script that zsh also sources leaves the environment name unescaped; from 21.13.0 until 21.14.4, it escapes backslashes, dollar signs, and backticks only when BASH_VERSION is set, so zsh receives the raw value. The script assigns that value to PS1. In zsh with PROMPT_SUBST, an attacker-influenced environment directory, --prompt, or VIRTUALENV_PROMPT value containing command, parameter, or arithmetic expansion syntax can therefore execute commands in the user's shell each time the prompt is drawn. A percent sign is separately interpreted as a zsh prompt escape but does not by itself execute commands. Plain zsh with PROMPT_SUBST disabled and bash are not affected by this mechanism. This issue is fixed in version 21.14.4.12dCVE-2026-1137047.3 ALT43.9%
——13A vulnerability has been found in a2aproject a2a-rs up to 0.4.3. This affects the function HttpPushSender of the file crates/server/src/push_notification_sender.rs of the component Push Notification Handler. Such manipulation of the argument TaskPushNotificationConfig leads to server-side request forgery. The attack may be launched remotely. The name of the patch is 2ba50176ea9f222d9a7d0f0e8cfe6fae7cf4c224. Applying a patch is advised to resolve this issue.18dCVE-2026-1133448.8 ALT18.2%
——5Improper state validation in Performance in Google Chrome prior to 156.0.8078.47 allowed a local attacker to read memory via a local program. (Chromium security severity: Medium)5dCVE-2026-1133438.8 ALT35.5%
——11Incorrect authorization in Sandbox in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)5dCVE-2026-1133429.6 CRÍ29.7%
——9Privilege elevation in Network in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)5dCVE-2026-1133416.5 MÉD39.7%
——12Use after free in Skia in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)5dCVE-2026-1133406.5 MÉD31.3%
——9Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)5dCVE-2026-1133398.8 ALT38.8%
——12Use after free in SVG in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)5dCVE-2026-1133388.8 ALT38.8%
——12Use after free in Turbolev in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)18dCVE-2026-1133378.8 ALT38.8%
——12Use after free in Scroll in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)5dCVE-2026-1133369.6 CRÍ42.7%
——13Use after free in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)5dCVE-2026-1133358.8 ALT19.2%
——6Race condition in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. (Chromium security severity: Medium)5dCVE-2026-1133348.8 ALT42.1%
——13Buffer overflow in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)5dCVE-2026-1133336.5 MÉD16.2%
——5Race condition in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Medium)5dCVE-2026-1133328.8 ALT34.8%
——10Uninitialized resource in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)5dCVE-2026-1133318.8 ALT31.1%
——9Observable discrepancy in Controls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)5dCVE-2026-1133308.8 ALT16.9%
——5Incorrect authorization in CustomTabs in Google Chrome on on Android prior to 156.0.8078.47 allowed a local attacker to obtain cross-origin data via a co-installed app. (Chromium security severity: Low)5dCVE-2026-1133296.5 MÉD13.5%
——4Race condition in Installer in Google Chrome on on Mac prior to 156.0.8078.47 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. (Chromium security severity: Medium)5dCVE-2026-1133289.6 CRÍ31.4%
——9Improper resource exposure in Privacy in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)5dCVE-2026-1133278.8 ALT29.5%
——9Missing authorization in Chromecast in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)5dCVE-2026-1133266.5 MÉD35.3%
——11Improper input validation in Core in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)5dCVE-2026-1133256.5 MÉD26.4%
——8Missing authorization in SignIn in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)5dCVE-2026-1133248.8 ALT34.8%
——10Uninitialized resource in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)5dCVE-2026-1133238.8 ALT31.1%
——9UI misrepresentation in Chrome for iOS in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)5dCVE-2026-1133226.5 MÉD31.3%
——9Uninitialized resource in Dawn in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)5dCVE-2026-1133218.8 ALT26.2%
——8Missing authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain cross-origin data via a crafted Chrome extension. (Chromium security severity: Medium)5dCVE-2026-1133208.8 ALT31.4%
——9UI misrepresentation in Navigation in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof address bar via a crafted HTML page. (Chromium security severity: Medium)5dCVE-2026-1133198.8 ALT37.2%
——11Missing authorization in Accessibility in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)5dCVE-2026-1133188.8 ALT38.8%
——12Use after free in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)5dCVE-2026-1133178.8 ALT38.8%
——12Use after free in Accessibility in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)5dCVE-2026-1133168.8 ALT38.8%
——12Use after free in Views in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)5dCVE-2026-1133158.8 ALT34.8%
——10Uninitialized resource in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)5dCVE-2026-1133148.8 ALT32.0%
——10Observable discrepancy in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)5dCVE-2026-1133138.8 ALT33.1%
——10Incorrect authorization in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)5dCVE-2026-1133128.8 ALT31.1%
——9UI misrepresentation in Autofill in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)5dCVE-2026-1133118.8 ALT22.6%
——7Race condition in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)5dCVE-2026-1133106.5 MÉD24.6%
——7Use after free in Bluetooth in Google Chrome prior to 156.0.8078.47 allowed an adjacent attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)5dCVE-2026-1133096.5 MÉD35.3%
——11Use after free in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)5dCVE-2026-1133088.8 ALT31.1%
——9Inappropriate implementation in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)5d