CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 30/10/2026 |
| CVE-2026-107251 | MEDIO6.5 | Incorrect Authorization vulnerability in Drupal Entity Reference Manager (Merge entities) allows Forceful Browsing. This issue affects Entity Reference Manager (Merge entities) versions: from 0.0.0 to 1.0.3. | 30/10/2026 |
| CVE-2026-107250 | MEDIO5.9 | Vulnerability in Drupal ECA Helper. This issue affects ECA Helper versions: *.*. | 30/10/2026 |
| CVE-2026-107249 | CRÍTICO9.8 | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Block AJAX allows Object Injection. This issue affects Block AJAX versions: from 0.0.0 to 3.0.2. | 30/10/2026 |
| CVE-2026-91920 | MEDIO6.5 | A flaw was found in the ChunkReader component of the Undertow web server, which is used to handle chunked transfer encoding in HTTP requests. The issue occurs because a security check for the chunk size is performed before the value is shifted, allowing a specifically crafted 15-digit chunk size to bypass the limit and | 30/10/2026 |
| CVE-2026-74915 | ALTO8.8 | A web page that contains unusual WebGPU content loaded into the GPU GLES render process can trigger a OOB read and/or write crash in the GPU GLES user-space shared library. On certain platforms, when the process executing graphics workload has system privileges this could enable further exploits on the device. | 30/10/2026 |
| CVE-2026-74912 | CRÍTICO9.8 | On GPU systems with the security vulnerability fix for CVE-2026-49746 applied, the mapping range of graphics buffers is limited which causes errors when the mapping outside of that range.
Integer truncation caused when mapping GPU buffer pages in the buffer’s range 0GB - 4GB, produces error and limits the functionalit | 30/10/2026 |
| CVE-2026-65587 | MEDIO5.5 | A web page that contains unusual WebGPU content loaded into the GPU GLES render process can trigger an OOB write in the GPU user-space driver, leading to memory corruption and possible browser/GPU process crash.
The software writes data past the end of an intended memory offset. Writing outside the bounds of allocat | 30/10/2026 |
| CVE-2026-65586 | ALTO7.1 | Software installed and run as a non-privileged user may conduct improper GPU system calls to free memory in still in use, replace with another allocation and cause arbitrary memory reads or writes to physical memory pages.
A memory buffer managed by a CPU thread of control (driver) and accessed by a GPU thread of co | 30/10/2026 |
| CVE-2026-65584 | ALTO7.8 | Software installed and run as a non-privileged user may conduct improper GPU system calls causing a stack overflow in the kernel. The overflow occurs when processing resolved Linux/Android fence synchronization checkpoints, while user checkpoints are excluded from the stack array. Successful exploitation can cause kern | 30/10/2026 |
| CVE-2026-19199 | ALTO7.1 | Software installed and run as a non-privileged user may conduct improper system calls to allocate physical memory. A 32-bit integer overflow in the KM driver during page-to-byte conversion of an allocation size can result in an undersized kernel buffer allocation. This may allow unallocated or previously allocated phys | 30/10/2026 |
| CVE-2026-18629 | ALTO7.5 | A web page that contains unusual GPU shader code is loaded into the GPU compiler process and can lead memory allocation failure. If the allocation failure is not properly handled, the compiler may dereference a NULL pointer at a controlled offset, resulting in a crash of the compiler process. On certain platforms, when | 30/10/2026 |
| CVE-2026-15466 | ALTO7.0 | Software installed and run as a non-privileged user may conduct improper GPU system calls to cause race condition in hardware performance counters buffer’s destruction path leading to read and/or write UAF.
The race condition in the destruction path could lead to reference counter being decremented in non-atomical w | 30/10/2026 |
| CVE-2026-118475 | BAJO3.6 | A flaw was found in Eye of GNOME. When parsing a specially crafted PNG image containing malformed color profile metadata, the application fails to validate chunk boundaries while searching for a null terminator. An attacker could trick a user into opening a malicious image, causing the application to read past the allo | 30/10/2026 |
| CVE-2026-112922 | BAJO3.3 | A flaw was found in Ghostscript. A remote attacker could exploit this vulnerability by enticing a user to process a specially crafted PDF or PostScript document containing malicious mesh shading data. Due to improper bounds validation during the processing of indexed color values, Ghostscript triggers an out-of-bounds | 30/10/2026 |
| CVE-2026-76031 | ALTO8.8 | Incorrect authorization in Input in Google Chrome prior to 156.0.8078.79 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: High) | 30/10/2026 |
| CVE-2026-76030 | ALTO8.8 | Incorrect authorization in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) | 30/10/2026 |