CVE Vulnerability Catalog

Code injection in ReaderMode in Google Chrome on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page.

Confused deputy in SignIn in Google Chrome on Android prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions into a privileged page via a crafted HTML page.

Missing authorization in Permissions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page.

Uncontrolled search path element in CredentialProvider in Google Chrome on Windows prior to 155.0.8059.39 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. (Chromium security severity: Low)

Improper input validation in Viz in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page.

Uninitialized resource in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted HTML page.

Missing authorization in Chromoting in Google Chrome on Windows prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via crafted network traffic.

UI misrepresentation in Paint in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to spoof UI elements via a crafted HTML page.

Incorrect reference resolution in DevTools in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page.

Observable discrepancy in Animation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially obtain cross-origin data via a crafted HTML page.

UI misrepresentation in WebAppInstalls in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to spoof UI elements via a crafted HTML page.

The RabbitMQ Java client library prior to 5.35.0 includes the raw URI value in wrapped exceptions when AMQP URI parsing fails. Because the URI may contain a plaintext username and password, broker credentials can be disclosed through startup logs, monitoring systems, CI logs, and copied stack traces.

The RabbitMQ Java client library prior to 5.36.0 incorrectly decodes malformed UTF-8 bytes in ValueReader.readShortstr into replacement characters that re-encode beyond the AMQP shortstr limit. An attacker can submit an RPC message with a malformed property, causing an unchecked exception before acknowledgement and repeated message requeueing that disables consumers.

The RabbitMQ Java client library prior to 5.37.0 has a flaw in com.rabbitmq.tools.json.JSONReader.read() that fails to terminate when input ends inside a quoted string or line comment. The default DefaultJsonRpcMapper can then exhaust the heap or consume CPU indefinitely, resulting in denial of service.

LiquidJS prior to 10.27.2 does not consistently enforce ownPropertyOnly for inherited array indices, as negative indexing, .first, .last, first/last filters, join, reverse, slice, compact, and for-loop iteration can read prototype-provided elements outside readJSProperty(). An attacker able to influence prototype state can disclose values that ownPropertyOnly is expected to hide.

LangChain prior to 1.3.1 does not enforce the documented string type for an untrusted structured session identifier at runtime, allowing it to be interpreted as a MongoDB query condition rather than a literal value. An attacker able to invoke chat-history operations can read, modify, or delete another user's stored conversation when histories are stored in a shared MongoDB collection.

In ImageSharp versions 3.0.0 through 4.1.1, tiled TIFF decoding allocates a destination buffer based on TileWidth while T4, T6, and Modified Huffman decompressors use the full frame width. When TileWidth is smaller than ImageWidth, frame-width fax scanlines are written into a tile-width buffer, causing out-of-bounds writes and heap corruption. The issue is fixed in version 4.1.1.

A DOM-based XSS vulnerability exists in the Ansible Platform UI due to unvalidated input handling in the redirect route. The application extracts a target from the next query parameter and assigns it directly to location.href, bypassing built-in URL validation and allowing arbitrary JavaScript execution in an authenticated user's session.

Missing authorization in the global vault in Devolutions Server 2026.3.7.0 and earlier allows an authenticated user with only the global vault view permission to modify and delete global contact and folder entries.

An authentication bypass in the OAuth device authorization flow in Devolutions Server 2026.3.7.0 and earlier allows a remote attacker to take over a user's account via replay of a captured device verification link by an authenticated victim.