Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
15,082 results · page 93 of 302
Mar 2, 2026In multiple locations, there is a possible out of bounds read and write due to a heap buffer overflow.CVE-2026-0006 · Computers, phones & browsers · Google · reported by security@android.comCritical 9.8
In multiple locations, there is a possible out of bounds read and write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026In onServiceDisconnected of KeyguardServiceDelegate.java, there is a possible partial bypass of app pinning allowing limited interaction with other apps withoutCVE-2026-0005 · Computers, phones & browsers · Google · reported by security@android.comMedium 6.2
In onServiceDisconnected of KeyguardServiceDelegate.java, there is a possible partial bypass of app pinning allowing limited interaction with other apps without knowing the LSKF due to a missing permission check. This could lead to local information disclosure where the extent of interaction and impact is app-dependent with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026In onStart of CompanionDeviceManagerService.java, there is a possible confused deputy due to a logic error in the code.CVE-2025-48654 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In onStart of CompanionDeviceManagerService.java, there is a possible confused deputy due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026In loadDataAndPostValue of multiple files, there is a possible way to obscure permission usage due to a logic error in the code.CVE-2025-48653 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In loadDataAndPostValue of multiple files, there is a possible way to obscure permission usage due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026In multiple locations, there is a possible information disclosure due to SQL injection.CVE-2025-48650 · Computers, phones & browsers · Google · reported by security@android.comHigh 8.4
In multiple locations, there is a possible information disclosure due to SQL injection. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026In executeRequest of ActivityStarter.java, there is a possible launch anywhere due to a confused deputy.CVE-2025-48646 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In executeRequest of ActivityStarter.java, there is a possible launch anywhere due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026In loadDescription of DeviceAdminInfo.java, there is a possible persistent package due to improper input validation.CVE-2025-48645 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In loadDescription of DeviceAdminInfo.java, there is a possible persistent package due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026In multiple locations, there is a possible persistent denial of service due to improper input validation.CVE-2025-48644 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In multiple locations, there is a possible persistent denial of service due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026In jump_to_payload of payload.rs, there is a possible information disclosure due to a logic error in the code.CVE-2025-48642 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In jump_to_payload of payload.rs, there is a possible information disclosure due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026In multiple functions of Nfc.h, there is a possible use after free due to a race condition.CVE-2025-48641 · Computers, phones & browsers · Google · reported by security@android.comHigh 7
In multiple functions of Nfc.h, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026In openFile of BugreportContentProvider.java, there is a possible way to read and write unauthorized files due to a path traversal error.CVE-2025-48636 · Computers, phones & browsers · Google · reported by security@android.comHigh 8.4
In openFile of BugreportContentProvider.java, there is a possible way to read and write unauthorized files due to a path traversal error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026In multiple functions of TaskFragmentOrganizerController.java, there is a possible activity token leak due to a logic error in the code.CVE-2025-48635 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.7
In multiple functions of TaskFragmentOrganizerController.java, there is a possible activity token leak due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026In relayoutWindow of WindowManagerService.java, there is a possible tapjack attack due to a missing permission check.CVE-2025-48634 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.3
In relayoutWindow of WindowManagerService.java, there is a possible tapjack attack due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026In drawLayersInternal of SkiaRenderEngine.cpp, there is a possible way to access the GPU cache due to side channel information disclosure.CVE-2025-48630 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.4
In drawLayersInternal of SkiaRenderEngine.cpp, there is a possible way to access the GPU cache due to side channel information disclosure. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026In multiple functions of ContentProvider.java, there is a possible way for an app with read-only access to truncate files due to a logic error in the code.CVE-2025-48619 · Computers, phones & browsers · Google · reported by security@android.comHigh 8.4
In multiple functions of ContentProvider.java, there is a possible way for an app with read-only access to truncate files due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026In VBMeta, there is a possible way to modify and resign VBMeta using a test key, assuming the original image was previously signed with the same key.CVE-2025-48613 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In VBMeta, there is a possible way to modify and resign VBMeta using a test key, assuming the original image was previously signed with the same key. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026In multiple functions of MmsProvider.java, there is a possible way to arbitrarily delete files which affect telephony, SMS, and MMS functionalities due to a patCVE-2025-48609 · Computers, phones & browsers · Google · reported by security@android.comCritical 9.1
In multiple functions of MmsProvider.java, there is a possible way to arbitrarily delete files which affect telephony, SMS, and MMS functionalities due to a path traversal error. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026In multiple functions of KeyguardViewMediator.java, there is a possible lockscreen bypass due to a logic error in the code.CVE-2025-48605 · Computers, phones & browsers · Google · reported by security@android.comHigh 8.4
In multiple functions of KeyguardViewMediator.java, there is a possible lockscreen bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026In exitKeyguardAndFinishSurfaceBehindRemoteAnimation of KeyguardViewMediator.java, there is a possible lockscreen bypass due to a logic error in the code.CVE-2025-48602 · Computers, phones & browsers · Google · reported by security@android.comHigh 8.4
In exitKeyguardAndFinishSurfaceBehindRemoteAnimation of KeyguardViewMediator.java, there is a possible lockscreen bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026In multiple functions of ProfilingService.java, there is a possible persistent denial of service due to improper input validation.CVE-2025-48587 · Computers, phones & browsers · Google · reported by security@android.comMedium 6.2
In multiple functions of ProfilingService.java, there is a possible persistent denial of service due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026In multiple functions of ProfilingService.java, there is a possible persistent denial of service due to improper input validation.CVE-2025-48585 · Computers, phones & browsers · Google · reported by security@android.comMedium 6.2
In multiple functions of ProfilingService.java, there is a possible persistent denial of service due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026In multiple locations, there is a possible way to delete media without the MANAGE_EXTERNAL_STORAGE permission due to an intent redirect.CVE-2025-48582 · Computers, phones & browsers · Google · reported by security@android.comHigh 8.4
In multiple locations, there is a possible way to delete media without the MANAGE_EXTERNAL_STORAGE permission due to an intent redirect. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026In multiple functions of MediaProvider.java, there is a possible external storage write permission bypass due to a confused deputy.CVE-2025-48579 · Computers, phones & browsers · Google · reported by security@android.comHigh 8.4
In multiple functions of MediaProvider.java, there is a possible external storage write permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026In multiple functions of MediaProvider.java, there is a possible way to bypass the WRITE_EXTERNAL_STORAGE permission due to a missing permission check.CVE-2025-48578 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In multiple functions of MediaProvider.java, there is a possible way to bypass the WRITE_EXTERNAL_STORAGE permission due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026In multiple functions of KeyguardViewMediator.java, there is a possible lockscreen bypass due to a race condition.CVE-2025-48577 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.4
In multiple functions of KeyguardViewMediator.java, there is a possible lockscreen bypass due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026In validateAddingWindowLw of DisplayPolicy.java, there is a possible way for an app to intercept drag-and-drop events due to a missing permission check.CVE-2025-48574 · Computers, phones & browsers · Google · reported by security@android.comHigh 8.4
In validateAddingWindowLw of DisplayPolicy.java, there is a possible way for an app to intercept drag-and-drop events due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026In multiple locations, there is a possible lockscreen bypass due to a race condition.CVE-2025-48568 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.4
In multiple locations, there is a possible lockscreen bypass due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026In multiple locations, there is a possible bypass of a file path filter designed to prevent access to sensitive directories due to incorrect unicode normalizatCVE-2025-48567 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In multiple locations, there is a possible bypass of a file path filter designed to prevent access to sensitive directories due to incorrect unicode normalization. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026In UsageEvents of UsageEvents.java, there is a possible out of bounds write due to an incorrect bounds check.CVE-2025-32313 · Computers, phones & browsers · Google · reported by security@android.comHigh 8.4
In UsageEvents of UsageEvents.java, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026In multiple functions of btm_ble_sec.cc, there is a possible unencrypted communication due to Invalid error handling.CVE-2024-43766 · Computers, phones & browsers · Google · reported by security@android.comMedium 6.5
In multiple functions of btm_ble_sec.cc, there is a possible unencrypted communication due to Invalid error handling. This could lead to remote (proximal/adjacent) information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026In broadcastIntentLockedTraced of BroadcastController.java, there is a possible way to launch arbitrary activities from the background on the paired companion pCVE-2024-31328 · Computers, phones & browsers · Google · reported by security@android.comHigh 8.8
In broadcastIntentLockedTraced of BroadcastController.java, there is a possible way to launch arbitrary activities from the background on the paired companion phone due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Feb 27, 2026Arbitrary file write & potential privilege escalation exploiting zip slip vulnerability in Google Web Designer.CVE-2026-3223 · Computers, phones & browsers · Google · reported by cve-coordination@google.comHigh 8.4
Arbitrary file write & potential privilege escalation exploiting zip slip vulnerability in Google Web Designer.
- Product
- Web Designer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2026A vulnerability in Google Cloud Vertex AI Workbench from 7/21/2025 to 01/30/2026 allows an attacker to exfiltrate valid Google Cloud access tokens of other userCVE-2026-2244 · Computers, phones & browsers · Google Cloud · reported by f45cbf4e-4146-4068-b7e1-655ffc2c548cHigh 8.4
A vulnerability in Google Cloud Vertex AI Workbench from 7/21/2025 to 01/30/2026 allows an attacker to exfiltrate valid Google Cloud access tokens of other users via abuse of a built-in startup script. All instances after January 30th, 2026 have been patched to protect from this vulnerability. No user action is required for this.
- Product
- Vertex AI Workbench
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2026Inappropriate implementation in DevTools in Google Chrome prior to 145.0.7632.116 allowed an attacker who convinced a user to install a malicious extension to iCVE-2026-3063 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 5.4
Inappropriate implementation in DevTools in Google Chrome prior to 145.0.7632.116 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via DevTools. (Chromium security severity: High)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Feb 23, 2026Out of bounds read and write in Tint in Google Chrome on Mac prior to 145.0.7632.116 allowed a remote attacker to perform out of bounds memory access via a crafCVE-2026-3062 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comCritical 9.8
Out of bounds read and write in Tint in Google Chrome on Mac prior to 145.0.7632.116 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Feb 23, 2026Out of bounds read in Media in Google Chrome prior to 145.0.7632.116 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.CVE-2026-3061 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comCritical 9.1
Out of bounds read in Media in Google Chrome prior to 145.0.7632.116 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Feb 20, 2026Predictable bucket naming in Vertex AI Experiments in Google Cloud Vertex AI from version 1.21.0 up to (but not including) 1.133.0 on Google Cloud Platform alloCVE-2026-2473 · Computers, phones & browsers · Google Cloud · reported by f45cbf4e-4146-4068-b7e1-655ffc2c548cHigh 7.7
Predictable bucket naming in Vertex AI Experiments in Google Cloud Vertex AI from version 1.21.0 up to (but not including) 1.133.0 on Google Cloud Platform allows an unauthenticated remote attacker to achieve cross-tenant remote code execution, model theft, and poisoning via pre-creating predictably named Cloud Storage buckets (Bucket Squatting). This vulnerability was patched and no customer action is needed.
- Product
- Vertex AI Experiments
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2026Stored Cross-Site Scripting (XSS) in the _genai/_evals_visualization component of Google Cloud Vertex AI SDK (google-cloud-aiplatform) versions from 1.98.0 up tCVE-2026-2472 · Computers, phones & browsers · Google Cloud · reported by f45cbf4e-4146-4068-b7e1-655ffc2c548cHigh 8.6
Stored Cross-Site Scripting (XSS) in the _genai/_evals_visualization component of Google Cloud Vertex AI SDK (google-cloud-aiplatform) versions from 1.98.0 up to (but not including) 1.131.0 allows an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's Jupyter or Colab environment via injecting script escape sequences into model evaluation results or dataset JSON data.
- Product
- Vertex AI SDK for Python
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.cloud.google.comgithub.com
Feb 20, 2026Sync Master Sheet – Product Sync with Google Sheet for WooCommerce: Missing AuthorizationCVE-2025-68834 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Saiful Islam Sync Master Sheet – Product Sync with Google Sheet for WooCommerce product-sync-master-sheet allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sync Master Sheet – Product Sync with Google Sheet for WooCommerce: from n/a through <= 1.1.3.
- Product
- Sync Master Sheet – Product Sync with Google Sheet for WooCommerce
- Affected
- up to 1.1.3
- What to do
- Affects up to 1.1.3. Update Sync Master Sheet – Product Sync with Google Sheet for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026GA4WP: Google Analytics for: Missing AuthorizationCVE-2025-68028 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Passionate Brains GA4WP: Google Analytics for WordPress ga-for-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GA4WP: Google Analytics for WordPress: from n/a through <= 2.10.0.
- Product
- GA4WP: Google Analytics for
- Affected
- up to 2.10.0
- What to do
- Affects up to 2.10.0. Update GA4WP: Google Analytics for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026WPForms Google Sheet Connector: Improper Control of Generation of Code ('Code Injection')CVE-2025-67979 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Improper Control of Generation of Code ('Code Injection') vulnerability in WesternDeal WPForms Google Sheet Connector gsheetconnector-wpforms allows Code Injection.This issue affects WPForms Google Sheet Connector: from n/a through <= 4.0.1.
- Product
- WPForms Google Sheet Connector
- Affected
- up to 4.0.1
- What to do
- Affects up to 4.0.1. Update WPForms Google Sheet Connector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026A SSRF and Arbitrary File Read vulnerability in AppSheet Core in Google AppSheet prior to 2025-11-23 allows an authenticated remote attacker to read sensitive lCVE-2026-2274 · Other software · AppSheet · reported by f45cbf4e-4146-4068-b7e1-655ffc2c548cHigh 8.5
A SSRF and Arbitrary File Read vulnerability in AppSheet Core in Google AppSheet prior to 2025-11-23 allows an authenticated remote attacker to read sensitive local files and access internal network resources via crafted requests to the production cluster. This vulnerability was patched and no customer action is needed.
- Product
- AppSheet Web (Main Server)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2026iXML – Google XML sitemap generator: Reflected Cross-Site ScriptingCVE-2025-14076 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The iXML – Google XML sitemap generator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'iXML_email' parameter in all versions up to, and including, 0.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- iXML – Google XML sitemap generator
- Affected
- up to 0.6
- What to do
- Affects up to 0.6. Update iXML – Google XML sitemap generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 18, 2026Heap buffer overflow in Media in Google Chrome prior to 145.0.7632.109 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.CVE-2026-2650 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 8.8
Heap buffer overflow in Media in Google Chrome prior to 145.0.7632.109 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Feb 18, 2026Integer overflow in V8 in Google Chrome prior to 145.0.7632.109 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.CVE-2026-2649 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 8.8
Integer overflow in V8 in Google Chrome prior to 145.0.7632.109 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Feb 18, 2026Heap buffer overflow in PDFium in Google Chrome prior to 145.0.7632.109 allowed a remote attacker to perform an out of bounds memory write via a crafted PDF filCVE-2026-2648 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 8.8
Heap buffer overflow in PDFium in Google Chrome prior to 145.0.7632.109 allowed a remote attacker to perform an out of bounds memory write via a crafted PDF file. (Chromium security severity: High)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Feb 16, 2026WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters: Local File InclusionCVE-2025-12062 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.8.6 via the fc_load_template function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to include and execute arbitrary .html files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .html file types can be uploaded and included.
- Product
- WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters
- Affected
- up to 4.8.6
- What to do
- Affects up to 4.8.6. Update WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 14, 2026Best-wp-google-map: Stored Cross-Site ScriptingCVE-2026-1096 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Best-wp-google-map plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'latitude' and 'longitudinal' parameters of the 'google_map_view' shortcode in all versions up to, and including, 2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Best-wp-google-map
- Affected
- up to 2.1
- What to do
- Affects up to 2.1. Update Best-wp-google-map to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 13, 2026Google Chromium CSS Use-After-Free VulnerabilityCVE-2026-2441 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comExploitedHigh 8.8
Google Chromium CSS contains a use-after-free vulnerability that could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
- Product
- Chromium
- On CISA’s list since
- Feb 17, 2026 (federal fix deadline Mar 10, 2026)
- What to do
- Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogchromereleases.googleblog.comissues.chromium.org
Feb 11, 2026Arbitrary file read in the model loading mechanism (HDF5 integration) in Keras versions 3.0.0 through 3.13.1 on all supported platforms allows a remote attackerCVE-2026-1669 · Computers, phones & browsers · Google · reported by cve-coordination@google.comHigh 7.1
Arbitrary file read in the model loading mechanism (HDF5 integration) in Keras versions 3.0.0 through 3.13.1 on all supported platforms allows a remote attacker to read local files and disclose sensitive information via a crafted .keras model file utilizing HDF5 external dataset references.
- Product
- Keras
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comaccess.redhat.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.