Recent Advisories

Severity ID Title Vendor Product Date Type
CRITICAL 9.6 MS:CVE-2026-11660

Chromium: CVE-2026-11659 Insufficient validation of untrusted input in UI_MS:CVE-2026-11660

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Rel...

N/A N/A MSCVE
CRITICAL 9.6 MS:CVE-2026-11671

Chromium: CVE-2026-11670 Use after free in PDF_MS:CVE-2026-11671

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Rel...

N/A N/A MSCVE
CRITICAL 9.6 MS:CVE-2026-11672

Chromium: CVE-2026-11671 Use after free in Navigation_MS:CVE-2026-11672

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Rel...

N/A N/A MSCVE
CRITICAL 9.6 MS:CVE-2026-11697

Chromium: CVE-2026-11696 Uninitialized Use in Video_MS:CVE-2026-11697

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Rel...

N/A N/A MSCVE
CRITICAL 9.6 MS:CVE-2026-11698

Chromium: CVE-2026-11697 Insufficient validation of untrusted input in UI_MS:CVE-2026-11698

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Rel...

N/A N/A MSCVE
CRITICAL 9.1 CVE-2026-48714

i18next-http-middleware missingKeyHandler does not reject keys whose segments contain prototype-polluting names_CVE-2026-48714

i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. In versions prior to 3.9....

i18next i18next-http-middleware < 3.9.7 CVE
CRITICAL 9.1 CVE-2026-48713

i18next-fs-backend: Prototype pollution via crafted missing-key string_CVE-2026-48713

Versions prior to 2.6.6 are vulnerable to prototype pollution via crafted missing-key strings when used to persist missing translation keys (e.g. v...

i18next i18next-fs-backend < 2.6.6 CVE
CRITICAL 9.2 CVE-2026-48853

Remote code execution and denial of service via unsafe Erlang term deserialization in elixir-grpc/grpc_CVE-2026-48853

Deserialization of Untrusted Data and Allocation of Resources Without Limits or Throttling vulnerabilities in elixir-grpc grpc allow unauthenticate...

elixir-grpc grpc 0.4.0 CVE
CRITICAL 9.8 CVE-2026-50628

Apache CXF: OAuth2: Inverted IP Binding Check Defeats Security Control_CVE-2026-50628

A logic error in OAuthRequestFilter rejects legitimate requests originating from the bound IP address, while blindly allowing requests from any oth...

Apache Software Foundation Apache CXF 4.2.0 CVE
CRITICAL 9.1 CVE-2026-50627

Apache CXF: OAuth2: Missing JWT Audience and Issuer Validation in Access Token Validator_CVE-2026-50627

The JwtAccessTokenValidator class in Apache CXF fails to validate the 'aud' (Audience) claims of incoming JWT access tokens. This allows a JWT issu...

Apache Software Foundation Apache CXF 4.2.0 CVE