CVE-2026-8605
In ScadaBR version 1.2.0, a Use of Hard-Coded Credentials vulnerability could allow an attacker to access the SCADA system as admin.
PUBLISHED
- Vendor
- ScadaBR
- Product
- ScadaBR
- Provider severity
- MEDIUM
- Conflicts
- 0
Data & Insights
CVE Explorer
Search one exact, source-linked CVE snapshot by CVE ID or explicit vendor and product tokens. Provider severity, KEV, conflicts, and stale state remain separate observations—not a Baitaphish risk rating.
Exact snapshot results
353,537 CVE records
CVE-2026-8604
In ScadaBR version 1.2.0, a CSRF vulnerability could allow an attacker to trigger any authenticated action through a victim's session by luring any logged-in user to a malicious webpage.
PUBLISHED
- Vendor
- ScadaBR
- Product
- ScadaBR
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-8603
In ScadaBR version 1.2.0, an OS Command Injection vulnerability could allow an attacker to execute commands as root on the SCADA system.
PUBLISHED
- Vendor
- ScadaBR
- Product
- ScadaBR
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-8602
In ScadaBR version 1.2.0, a Missing Authentication for Critical Function vulnerability could allow an unauthenticated attacker to send a HTTP GET requests to the SCADA system and inject arbitrary sensor readings.
PUBLISHED
- Vendor
- ScadaBR
- Product
- ScadaBR
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-8599
The MailerPress – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Campaign HTML Content Field in all versions up to, and including, 2.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The public-facing campa
PUBLISHED
- Vendor
- mailerpress
- Product
- MailerPress – Email Marketing, Newsletter, Email Automation & WooCommerce Emails
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2026-8598
An undocumented configuration export port is accessible on some models of ZKTeco CCTV cameras. This port does not require authentication and exposes critical information about the camera such as open services and camera account credentials.
PUBLISHED
- Vendor
- ZKTeco
- Product
- SSC335-GC2063-Face-0b77 Solution Camera
- Provider severity
- CRITICAL
- Conflicts
- 1
CVE-2026-8597
Missing integrity verification in the Triton inference handler in Amazon SageMaker Python SDK v2 before v2.257.2 and v3 before v3.8.0 might allow a remote authenticated actor to achieve code execution in inference containers via replacement of model artifacts in S3 with a specially crafted pickle payload that is deserialized without verification. This issue requires a remote authenticated actor with S3 write access to the model artifact path. To remediate this issue, we recommend upgrading to
PUBLISHED
- Vendor
- Amazon SageMaker Python SDK
- Product
- AWS
- Provider severity
- HIGH, MEDIUM
- Conflicts
- 1
CVE-2026-8596
Cleartext storage of sensitive information in the ModelBuilder/Serve component in Amazon SageMaker Python SDK before v2.257.2 and v3 before v3.8.0 might allow a remote authenticated actor to extract the HMAC signing key from SageMaker API responses and forge valid integrity signatures for specially crafted model artifacts, achieving code execution in inference containers. This issue requires a remote authenticated actor with permissions to call SageMaker describe APIs and S3 write access to the
PUBLISHED
- Vendor
- Amazon SageMaker Python SDK
- Product
- AWS
- Provider severity
- HIGH
- Conflicts
- 1
CVE-2026-8595
A user with Editor permissions can craft a dashboard whose table (TableNG) panel contains a malicious field name that executes as a script in the browser of any user who views the dashboard (stored cross-site scripting).
PUBLISHED
- Vendor
- Grafana
- Product
- Grafana OSS
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2026-8594
Text::LineFold versions through 2019.001 for Perl duplicate the output based on the number of special break characters. Text::LineFold splits the input string by specific line break characters (such as VT, FF and others) into segments, but applies the break function to the entire string, not just the segment. A side effect of this is that the full input can be duplicated for each segment. Besides being incorrect, this can lead to unexpected resource consumption and possible denial of service.
PUBLISHED
- Vendor
- NEZUMI
- Product
- Text::LineFold
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2026-8593
Improper permission enforcement in Checkmk versions 2.5.0 before 2.5.0p9, 2.4.0 before 2.4.0p34, 2.3.0 before 2.3.0p49, and 2.2.0 (EOL) allows users without permissions to view and modify BI packs and rules
PUBLISHED
- Vendor
- Checkmk GmbH
- Product
- Checkmk
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2026-8592
OS Command Injection vulnerability in the process_string action of Rapid7 InsightConnect AWK Plugin on Linux allows remote attackers to execute arbitrary OS commands via the text or expression parameters due to unsafe shell command construction in the processing pipeline.
PUBLISHED
- Vendor
- Rapid7
- Product
- InsightConnect AWK Plugin
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-8590
Vulnerability in Spotfire Spotfire Enterprise (Spotfire Server modules), Spotfire Spotfire Enterprise with External Consumers (Spotfire Server modules), Spotfire Spotfire on Kubernetes (Spotfire Server modules). This issue affects Spotfire Enterprise: through 14.0.12, through 14.4.2, through 14.5.0, through 14.6.1, through 14.6.2, through 14.7.0, through 14.8.0; Spotfire Enterprise with External Consumers: through 14.0.12, through 14.5.0, through 14.6.0, through 14.6.1, through 14.6.2, through
PUBLISHED
- Vendor
- Spotfire, Spotfire, Spotfire
- Product
- Spotfire on Kubernetes, Spotfire Enterprise, Spotfire Enterprise with External Consumers
- Provider severity
- HIGH
- Conflicts
- 1
CVE-2026-8589
GitLab has remediated an issue in GitLab EE affecting all versions from 13.1.4 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain conditions could have allowed an authenticated user to add unauthorized email addresses to a targeted user's account due to improper sanitization of user-supplied input in certain group setting fields.
PUBLISHED
- Vendor
- GitLab
- Product
- GitLab
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-8587
Use after free in Extensions in Google Chrome on Mac prior to 148.0.7778.168 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code via a crafted Chrome Extension. (Chromium security severity: Medium)
PUBLISHED
- Vendor
- Product
- Chrome
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-8586
Inappropriate implementation in Chromoting in Google Chrome prior to 148.0.7778.168 allowed a local attacker to bypass discretionary access control via a malicious file. (Chromium security severity: Medium)
PUBLISHED
- Vendor
- Product
- Chrome
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2026-8585
Inappropriate implementation in Media in Google Chrome on iOS prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Medium)
PUBLISHED
- Vendor
- Product
- Chrome
- Provider severity
- HIGH
- Conflicts
- 1
CVE-2026-8584
Inappropriate implementation in Views in Google Chrome on iOS prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
PUBLISHED
- Vendor
- Product
- Chrome
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2026-8583
Insufficient policy enforcement in WebXR in Google Chrome on Android prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
PUBLISHED
- Vendor
- Product
- Chrome
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2026-8582
Object lifecycle issue in Dawn in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
PUBLISHED
- Vendor
- Product
- Chrome
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2026-8581
Use after free in GPU in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
PUBLISHED
- Vendor
- Product
- Chrome
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-8580
Use after free in Mojo in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
PUBLISHED
- Vendor
- Product
- Chrome
- Provider severity
- CRITICAL
- Conflicts
- 0
CVE-2026-8579
Insufficient validation of untrusted input in Skia in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to perform an out of bounds memory write via a crafted print file. (Chromium security severity: Medium)
PUBLISHED
- Vendor
- Product
- Chrome
- Provider severity
- LOW
- Conflicts
- 0
CVE-2026-8578
Out of bounds read in GPU in Google Chrome on Linux prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
PUBLISHED
- Vendor
- Product
- Chrome
- Provider severity
- LOW
- Conflicts
- 0
CVE-2026-8577
Integer overflow in Fonts in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
PUBLISHED
- Vendor
- Product
- Chrome
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-8576
Inappropriate implementation in CORS in Google Chrome on Linux and ChromeOS prior to 148.0.7778.168 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
PUBLISHED
- Vendor
- Product
- Chrome
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2026-8575
Use after free in UI in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
PUBLISHED
- Vendor
- Product
- Chrome
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-8574
Use after free in Core in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
PUBLISHED
- Vendor
- Product
- Chrome
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-8573
Integer overflow in Codecs in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escape via a crafted video file. (Chromium security severity: Medium)
PUBLISHED
- Vendor
- Product
- Chrome
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-8572
Insufficient policy enforcement in Network in Google Chrome on Android prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
PUBLISHED
- Vendor
- Product
- Chrome
- Provider severity
- LOW
- Conflicts
- 1
CVE-2026-8571
Insufficient policy enforcement in GPU in Google Chrome on Android prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
PUBLISHED
- Vendor
- Product
- Chrome
- Provider severity
- HIGH
- Conflicts
- 1
CVE-2026-8570
Type Confusion in V8 in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
PUBLISHED
- Vendor
- Product
- Chrome
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2026-8569
Out of bounds write in Codecs in Google Chrome on Mac prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escape via a crafted video file. (Chromium security severity: Medium)
PUBLISHED
- Vendor
- Product
- Chrome
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-8567
Integer overflow in ANGLE in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Medium)
PUBLISHED
- Vendor
- Product
- Chrome
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2026-8566
Insufficient policy enforcement in Payments in Google Chrome on Android prior to 148.0.7778.168 allowed a remote attacker to bypass discretionary access control via a crafted HTML page. (Chromium security severity: Medium)
PUBLISHED
- Vendor
- Product
- Chrome
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2026-8565
Inappropriate implementation in Downloads in Google Chrome on Mac prior to 148.0.7778.168 allowed an attacker who convinced a user to install a malicious extension to perform UI spoofing via a crafted Chrome Extension. (Chromium security severity: Medium)
PUBLISHED
- Vendor
- Product
- Chrome
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2026-8564
Incorrect security UI in Downloads in Google Chrome on Android and Mac prior to 148.0.7778.168 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
PUBLISHED
- Vendor
- Product
- Chrome
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2026-8563
Insufficient policy enforcement in IFrame Sandbox in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)
PUBLISHED
- Vendor
- Product
- Chrome
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2026-8562
Side-channel information leakage in Navigation in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
PUBLISHED
- Vendor
- Product
- Chrome
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2026-8561
Incorrect security UI in Fullscreen in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
PUBLISHED
- Vendor
- Product
- Chrome
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2026-8560
Heap buffer overflow in SwiftShader in Google Chrome on Mac and iOS prior to 148.0.7778.168 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Medium)
PUBLISHED
- Vendor
- Product
- Chrome
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2026-8559
Integer overflow in Internationalization in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High)
PUBLISHED
- Vendor
- Product
- Chrome
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2026-8558
Out of bounds write in Fonts in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
PUBLISHED
- Vendor
- Product
- Chrome
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-8557
Use after free in Accessibility in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to perform privilege escalation via a crafted HTML page. (Chromium security severity: High)
PUBLISHED
- Vendor
- Product
- Chrome
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-8556
Inappropriate implementation in ANGLE in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
PUBLISHED
- Vendor
- Product
- Chrome
- Provider severity
- LOW
- Conflicts
- 1
CVE-2026-8555
Use after free in GTK in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
PUBLISHED
- Vendor
- Product
- Chrome
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-8554
Type Confusion in ANGLE in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High)
PUBLISHED
- Vendor
- Product
- Chrome
- Provider severity
- LOW
- Conflicts
- 0
CVE-2026-8553
Use after free in GPU in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High)
PUBLISHED
- Vendor
- Product
- Chrome
- Provider severity
- LOW
- Conflicts
- 0
CVE-2026-8552
Heap buffer overflow in GPU in Google Chrome on Android prior to 148.0.7778.168 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High)
PUBLISHED
- Vendor
- Product
- Chrome
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2026-8551
Use after free in Downloads in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
PUBLISHED
- Vendor
- Product
- Chrome
- Provider severity
- HIGH
- Conflicts
- 0