CVE Vulnerability Catalog

Insufficient validation of untrusted input in ANGLE in Google Chrome on Mac prior to 147.0.7727.55. A remote attacker could execute arbitrary code inside a sandbox via a crafted HTML page.

Use-after-free in Navigation in Google Chrome prior to 147.0.7727.55. A remote attacker could execute arbitrary code inside a sandbox via a crafted HTML page.

Google Chrome before version 147.0.7727.55 has an out-of-bounds read and write vulnerability in V8, allowing a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.

Use-after-free in Blink in Google Chrome prior to 147.0.7727.55. A remote attacker could execute arbitrary code inside a sandbox via a crafted HTML page.

Type Confusion in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

An integer overflow in Skia in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. The vulnerability has a Chromium security severity of High.

A heap buffer overflow in ANGLE in Google Chrome on Mac prior to 147.0.7727.55 allows a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.

Use-after-free in Media in Google Chrome prior to 147.0.7727.55. A remote attacker could execute arbitrary code inside a sandbox via a crafted HTML page.

Google Chrome prior to version 147.0.7727.55 has a Type Confusion vulnerability in the V8 engine. A remote attacker can exploit a crafted HTML page to execute arbitrary code inside the browser sandbox.

Google Chrome prior to version 147.0.7727.55 has an inappropriate implementation in the V8 engine. A remote attacker can exploit this to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium severity: High.

Inappropriate implementation in V8 in Google Chrome prior to 147.0.7727.55. A remote attacker could execute arbitrary code inside a sandbox via a crafted HTML page.

Use-after-free in V8 in Google Chrome prior to 147.0.7727.55. A remote attacker could execute arbitrary code inside a sandbox via a crafted HTML page.

Google Chrome prior to version 147.0.7727.55 has a use-after-free vulnerability in the WebRTC component. A remote attacker can exploit a crafted HTML page to execute arbitrary code inside a sandbox. This vulnerability has a high Chromium security severity.

Integer overflow vulnerability in WebML in Google Chrome prior to version 147.0.7727.55 allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical).

Google Chrome prior to version 147.0.7727.55 has a heap buffer overflow in WebML that a remote attacker can exploit via a crafted HTML page to execute arbitrary code.

Unfurl before version 2026.04 has an unbounded zlib decompression vulnerability in parse_compressed.py. Attackers can send highly compressed payloads via URL parameters to the /json/visjs endpoint, which expand to gigabytes, exhausting server memory and causing denial of service.

UAC (Unix-like Artifacts Collector) before version 3.3.0-rc1 contains a command injection vulnerability in the placeholder substitution and command execution pipeline. The _run_command() function passes constructed command strings directly to eval without proper sanitization, allowing attackers to inject shell metacharacters through attacker-controlled inputs such as %line% values from foreach iterators and %user%/%user_home% values derived from system files.

MemProcFS before 5.17 has multiple unsafe library-loading patterns enabling DLL and shared-library hijacking across six attack surfaces. An attacker can place a malicious library in the working directory or manipulate LD_LIBRARY_PATH to achieve arbitrary code execution.

The parseusbs tool before version 1.9 contains an OS command injection vulnerability. The volume path argument (-v flag) is passed unsanitized to os.popen() with the ls command, allowing arbitrary command injection via shell metacharacters.

A vulnerability in parseusbs prior to version 1.9 allows OS command injection via unsanitized LNK file paths passed to os.popen(). An attacker can embed shell metacharacters in a .lnk filename, leading to arbitrary command execution on the forensic examiner's machine.