CVE Notifier

CVE-2026-92000 CWE-409 7.5

adm-zip 0.5.14 through 0.6.0 Denial of Service via Zero Declared Uncompressed Size

adm-zip versions 0.5.14 through 0.6.0 fail to apply zlib decompression output limits when ZIP entries declare zero uncompressed size. Attackers can craft malicious ZIP archives with highly compressible entries declaring …

cve.org cthackers:adm-zip 15 Sep 2026

CVE-2026-91939 CWE-502 9.8

Cotonti 1.0.0 Comments Plugin PHP Object Injection via ci Parameter

Cotonti 1.0.0 Comments plugin passes the ci GET parameter to unserialize() without allowed_classes restriction, allowing unauthenticated attackers to instantiate arbitrary PHP classes with attacker-controlled properties.…

cve.org Cotonti:Cotonti 15 Sep 2026

CVE-2026-61568 CWE-350 9.6

@zereight/mcp-gitlab: DNS rebinding reaches local Streamable HTTP MCP transport

`@zereight/mcp-gitlab` is a Model Context Protocol server for GitLab. Versions prior to 2.1.30 expose the Streamable HTTP MCP endpoint without an effective Host or Origin allowlist. A malicious web page can use DNS rebin…

cve.org zereight:gitlab-mcp 15 Sep 2026

CVE-2026-61554 CWE-400 7.5

emp3r0r has an unauthenticated HTTP Polling DoS

emp3r0r is a C2 designed by Linux users for Linux environments. Prior to version 4.2.5, the `http_poll` C2 transport accepts attacker-controlled HTTP polling sessions before CBOR `MsgAuth` authentication is completed. A …

cve.org jm33-m0:emp3r0r 15 Sep 2026

CVE-2026-91730 CWE-459 N/A

CVE-2026-91730

Incomplete cleanup in GetUserMedia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to obtain cross-origin data via a crafted HTM…

cve.org Google:Chrome 15 Sep 2026

CVE-2026-91722 CWE-416 N/A

CVE-2026-91722

Use after free in Input in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

cve.org Google:Chrome 15 Sep 2026

CVE-2026-91719 CWE-94 N/A

CVE-2026-91719

Code injection in XML in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)

cve.org Google:Chrome 15 Sep 2026

CVE-2026-91739 CWE-862 N/A

CVE-2026-91739

Missing authorization in Transactions Platform in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security s…

cve.org Google:Chrome 15 Sep 2026

CVE-2026-91738 CWE-20 N/A

CVE-2026-91738

Improper input validation in ANGLE in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

cve.org Google:Chrome 15 Sep 2026

CVE-2026-91725 CWE-203 N/A

CVE-2026-91725

Observable discrepancy in CSS in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security severity: Medium)

cve.org Google:Chrome 15 Sep 2026

CVE-2026-91713 CWE-862 N/A

CVE-2026-91713

Missing authorization in Browser in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Mediu…

cve.org Google:Chrome 15 Sep 2026

CVE-2026-91742 CWE-441 N/A

CVE-2026-91742

Confused deputy in PriceTracking in Google Chrome on on iOS prior to 153.0.8010.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions into a privileged page via crafted network t…

cve.org Google:Chrome 15 Sep 2026