CVE-2026-1220
published 2026-06-10CVE-2026-1220: Race in V8 in Google Chrome prior to 144.0.7559.99 allowed a remote attacker to potentially exploit type confusion via a crafted HTML page. (Chromium security…
PriorityP342high7.5CVSS 3.1
AVNACHPRNUIRSUCHIHAH
EPSS
0.30%
20.9th percentile
Race in V8 in Google Chrome prior to 144.0.7559.99 allowed a remote attacker to potentially exploit type confusion via a crafted HTML page. (Chromium security severity: High)
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | chromium | < chromium 144.0.7559.96-1~deb12u1 (bookworm) | chromium 144.0.7559.96-1~deb12u1 (bookworm) |
| chrome | < 144.0.7559.99 | 144.0.7559.99 | |
| chrome | >= 144.0.7559.99 < 144.0.7559.99 | 144.0.7559.99 | |
| chrome_chrome | — | — | |
| msrc | microsoft_edge | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
cisa7.8HIGH
vendor_redhat9.1CRITICAL
vendor_cisco5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Google Chrome up to 144.0.7559.59 V8 race condition (EUVD-2026-36108 / Nessus ID 294789)
vuldb·2026-06-11·CVSS 7.5
CVE-2026-1220 [HIGH] Google Chrome up to 144.0.7559.59 V8 race condition (EUVD-2026-36108 / Nessus ID 294789)
A vulnerability has been found in Google Chrome and classified as problematic. Impacted is an unknown function of the component V8. The manipulation leads to race condition.
This vulnerability is traded as CVE-2026-1220. It is possible to initiate the attack remotely. There is no exploit available.
The affected component should be upgraded.
GHSA
Race in V8 in Google Chrome prior to 144.0.7559.99 allowed a remote attacker to potentially exploit type confusion via a crafted HTML page.
ghsa_unreviewed·2026-06-10
CVE-2026-1220 [HIGH] CWE-362 Race in V8 in Google Chrome prior to 144.0.7559.99 allowed a remote attacker to potentially exploit type confusion via a crafted HTML page.
Race in V8 in Google Chrome prior to 144.0.7559.99 allowed a remote attacker to potentially exploit type confusion via a crafted HTML page. (Chromium security severity: High)
GHSA
Keycloak: Information disclosure due to user profile permission bypass
ghsa·2026-06-05
CVE-2026-9088 [LOW] CWE-1220 Keycloak: Information disclosure due to user profile permission bypass
Keycloak: Information disclosure due to user profile permission bypass
A flaw was found in org.keycloak.services. An administrator with delegated access to read group memberships and users can bypass user profile permissions by accessing the group members endpoint. This allows the administrator to view user attributes that are explicitly configured to be denied, leading to information disclosure.
GHSA
Apache Airflow's authenticated /ui/dags endpoint did not enforce per-DAG access control on embedded Human-in-the-Loop (HITL) and TaskInstance record
ghsa·2026-04-24
CVE-2026-38743 [MEDIUM] CWE-1220 Apache Airflow's authenticated /ui/dags endpoint did not enforce per-DAG access control on embedded Human-in-the-Loop (HITL) and TaskInstance record
Apache Airflow's authenticated /ui/dags endpoint did not enforce per-DAG access control on embedded Human-in-the-Loop (HITL) and TaskInstance record
The authenticated /ui/dags endpoint did not enforce per-DAG access control on embedded Human-in-the-Loop (HITL) and TaskInstance records: a logged-in Airflow user with read access to at least one DAG could retrieve HITL prompts (including their request parameters) and full TaskInstance details for DAGs outside their authorized scope. Because HITL prompts and TaskInstance fields routinely carry operator parameters and free-form context attached to a task, the leak widens visibility of DAG-run data beyond the intended per-DAG RBAC boundary for every authenticated user.
Users are recommended to upgrade to version 3.2.1 , which fixes this issue.
GitLab
Insufficient Granularity of Access Control in GitLab
vendor_gitlab·2026-10-13·CVSS 4.3
CVE-2026-14210 CWE-1220 Insufficient Granularity of Access Control in GitLab
Insufficient Granularity of Access Control in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.11 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with a project-scoped fine-grained Personal Access Token to permanently delete or modify group-level labels, due to incorrect authorization logic on label ownership scope validation.
Affected products: GitLab
Affected versions: >=18.11, =19.3, =19.4, <19.4.2 (affected)
Solution: Upgrade to versions 19.2.8, 19.3.5, 19.4.2 or above.
Credit: Thanks [bate5a](https://hackerone.com/bate5a) for reporting this vulnerability through our HackerOne bug bounty program
Red Hat
kernel: PCI/sysfs: Add CAP_SYS_ADMIN check to __resource_resize_store()
vendor_redhat·2026-09-24·CVSS 7.0
CVE-2026-97505 [MEDIUM] CWE-1220 kernel: PCI/sysfs: Add CAP_SYS_ADMIN check to __resource_resize_store()
kernel: PCI/sysfs: Add CAP_SYS_ADMIN check to __resource_resize_store()
In the Linux kernel, the following vulnerability has been resolved:
PCI/sysfs: Add CAP_SYS_ADMIN check to __resource_resize_store()
Currently, the __resource_resize_store() allows writing to the
resourceN_resize sysfs attribute to change a BAR's size without checking
for capabilities, currently relying only on the file access check.
Resizing a BAR modifies PCI device configuration and can disrupt active
drivers. After the upcoming conversion to static attributes, it will also
trigger resource file updates via sysfs_update_groups().
Add a CAP_SYS_ADMIN check to prevent unprivileged users from performing BAR
resize operations.
A flaw was found in the Linux kernel. Missing authorization checks in the PCI sysfs interface
Red Hat
rabbitmq: RabbitMQ: Authenticated user can bypass connection limits via stream protocol
vendor_redhat·2026-09-23·CVSS 6.0
CVE-2026-66067 [MEDIUM] CWE-1220 rabbitmq: RabbitMQ: Authenticated user can bypass connection limits via stream protocol
rabbitmq: RabbitMQ: Authenticated user can bypass connection limits via stream protocol
A flaw was found in RabbitMQ. The stream protocol handler does not correctly enforce per-user and per-virtual host (vhost) connection limits. An authenticated user can exploit this by connecting through port 5552, bypassing the intended connection restrictions. This could lead to resource exhaustion and a denial of service (DoS) for the RabbitMQ broker.
Package: rabbitmq-server4.2 (Red Hat Hardened Images) - Will not fix
Package: rabbitmq-server4.3 (Red Hat Hardened Images) - Affected
Red Hat
kernel: bpf: Reject writes through untrusted BTF pointers
vendor_redhat·2026-09-17·CVSS 7.8
CVE-2026-93144 [HIGH] CWE-1220 kernel: bpf: Reject writes through untrusted BTF pointers
kernel: bpf: Reject writes through untrusted BTF pointers
In the Linux kernel, the following vulnerability has been resolved:
bpf: Reject writes through untrusted BTF pointers
check_ptr_to_btf_access() lets program-type btf_struct_access callbacks
validate writes before the default BTF access path rejects non-read
accesses. That bypasses the read-only policy for untrusted BTF pointers
created by helpers such as bpf_rdonly_cast().
Reject non-read accesses through PTR_UNTRUSTED BTF pointers at the
common entry point, before the callback branch to handle all cases.
A flaw was found in the Linux kernel's Berkeley Packet Filter (BPF) subsystem. The `check_ptr_to_btf_access()` function, which is responsible for validating memory access through BPF Type Format (BTF) pointers, incorrectly allowe
Red Hat
firefox: thunderbird: Mitigation bypass in the Enterprise Policies component
vendor_redhat·2026-09-15·CVSS 6.1
CVE-2026-92057 [MEDIUM] CWE-1220 firefox: thunderbird: Mitigation bypass in the Enterprise Policies component
firefox: thunderbird: Mitigation bypass in the Enterprise Policies component
Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue:
Mitigation bypass in the Enterprise Policies component
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.
Package: firefox (Red Hat Enterprise Linux 10) - Not affected
Package: rhel10/firefox-flatpak (Red Hat Enterprise Linux 10) - Not affected
Package: rhel10/thunderbird-flatpak (Red Hat Enterprise Linux 10) - Not affected
Package: thunderbird (Red Hat Enter
Red Hat
kube-controller-manager: kube-controller-manager: StatefulSet and ControllerRevision write permissions allow cross-namespace pod creation
vendor_redhat·2026-09-15·CVSS 5.9
CVE-2026-2270 [MEDIUM] CWE-1220 kube-controller-manager: kube-controller-manager: StatefulSet and ControllerRevision write permissions allow cross-namespace pod creation
kube-controller-manager: kube-controller-manager: StatefulSet and ControllerRevision write permissions allow cross-namespace pod creation
A flaw was found in Kubernetes kube-controller-manager. The StatefulSet controller restores ControllerRevision data onto the whole StatefulSet object, including metadata. A user with namespace-scoped write access to StatefulSet and ControllerRevision can cause the controller to create a pod in another namespace. That pod is deleted by garbage collection unless the attacker can name the UID of a StatefulSet in the target namespace.
Statement: The attacker needs write on both StatefulSet and ControllerRevision in some namespace, plus a way to make the controller apply that revision. Default OpenShift edit and admin roles do not grant ControllerRevision c
Red Hat
kernel: Linux kernel (Landlock): Security bypass via improper whiteout creation permissions
vendor_redhat·2026-09-11·CVSS 5.3
CVE-2026-89560 [MEDIUM] CWE-1220 kernel: Linux kernel (Landlock): Security bypass via improper whiteout creation permissions
kernel: Linux kernel (Landlock): Security bypass via improper whiteout creation permissions
A flaw was found in the Linux kernel's Landlock security module. This vulnerability allowed for the creation of 'whiteout' objects without proper permission checks. Whiteout objects are special files used in OverlayFS to hide underlying files, and their unauthorized creation could lead to unexpected file system behavior or bypass security restrictions. A local attacker could exploit this by using specific mknod(2) or renameat2(2) system calls.
Package: openshift/ose-rhel-coreos-8 (Red Hat OpenShift Container Platform 4) - Fix deferred
Package: openshift/ose-rhel-coreos-9 (Red Hat OpenShift Container Platform 4) - Fix deferred
Red Hat
github.com/traefik/traefik: Traefik: Information disclosure via crossProviderNamespaces bypass in Kubernetes Ingress provider
vendor_redhat·2026-09-04·CVSS 7.0
CVE-2026-85594 [HIGH] CWE-1220 github.com/traefik/traefik: Traefik: Information disclosure via crossProviderNamespaces bypass in Kubernetes Ingress provider
github.com/traefik/traefik: Traefik: Information disclosure via crossProviderNamespaces bypass in Kubernetes Ingress provider
A flaw was found in Traefik. The software fails to enforce `crossProviderNamespaces` restrictions on the `traefik.ingress.kubernetes.io/service.middlewares` Service annotation within the Kubernetes Ingress provider. This vulnerability allows a namespace-limited tenant, even if excluded from the allowlist, to attach an operator-owned middleware to its Service. If this middleware injects backend credentials, the tenant can then recover these credentials at a controlled backend, leading to information disclosure.
Statement: A flaw was found in Traefik's Kubernetes Ingress provider (v3.7.1 through v3.7.10) where crossProviderNamespaces isolation is not enforced for th
Red Hat
inets: otp: inets httpd mod_auth: Authentication Bypass via Directory Namespace Collapse
vendor_redhat·2026-09-01·CVSS 6.0
CVE-2026-74994 [MEDIUM] CWE-1220 inets: otp: inets httpd mod_auth: Authentication Bypass via Directory Namespace Collapse
inets: otp: inets httpd mod_auth: Authentication Bypass via Directory Namespace Collapse
The mod_auth module in OTP's inets httpd server, when configured with dets or mnesia authentication backends and multiple directory configuration blocks, collapses all directory blocks into a single shared user/group namespace. A user added to one protected directory is accepted as valid for all other protected directories on the same server instance.
This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.
A flaw was found in the `mod_auth`
Red Hat
sudo: Sudo: Policy bypass allows unauthorized program execution via execveat
vendor_redhat·2026-08-29·CVSS 7.8
CVE-2026-82474 [HIGH] CWE-1220 sudo: Sudo: Policy bypass allows unauthorized program execution via execveat
sudo: Sudo: Policy bypass allows unauthorized program execution via execveat
A flaw was found in Sudo. This vulnerability allows users who are permitted to run specific commands to bypass security policy checks when using the `execveat` system call in ptrace-based intercept mode. By directly calling `execveat` or `fexecve`, an attacker can execute programs that would otherwise be denied, thereby circumventing policy enforcement and logging mechanisms.
Statement: This vulnerability in Sudo allows a local attacker, already authorized to run specific commands, to bypass configured policy restrictions. By directly invoking `execveat` or `fexecve` when Sudo is operating in ptrace-based intercept mode, an attacker can execute programs otherwise denied by `sudo` policies. This undermines granul
Red Hat
kernel: drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE
vendor_redhat·2026-08-28·CVSS 5.5
CVE-2026-80703 [MEDIUM] CWE-1220 kernel: drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE
kernel: drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE
In the Linux kernel, the following vulnerability has been resolved:
drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE
Prevent unauthorized termination of active GPU debug sessions.
Previously, users with /dev/kfd access could terminate another process's
debug session without proper ownership or ptrace authorization.
(cherry picked from commit 4db4c5ffd5585b72622ecf6ffedf2da258ee23f5)
A flaw was found in the Linux kernel's drm/amdkfd component. A local user with access to /dev/kfd could exploit a missing authorization check to terminate another process's active Graphics Processing Unit (GPU) debug session. This could lead to a denial of service for other users attempting to debug GPU appl
Red Hat
kernel: xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink
vendor_redhat·2026-08-15·CVSS 8.8
CVE-2026-72136 [HIGH] CWE-1220 kernel: xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink
kernel: xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink
A flaw was found in the Linux kernel's `xfrm_interface` component. A local attacker with specific network administration privileges in one network namespace could exploit this vulnerability to modify the configuration of a network interface in a different network namespace where they are not authorized. This could lead to unauthorized changes to network settings or privilege escalation.
Package: kernel (Red Hat Enterprise Linux 10) - Affected
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affected
Package: kernel (Red Hat Enterprise Linux 8) - Not affected
Package: kernel-
Red Hat
kernel: perf/x86/amd/brs: Fix kernel address leakage
vendor_redhat·2026-08-15·CVSS 5.5
CVE-2026-72237 [MEDIUM] CWE-1220 kernel: perf/x86/amd/brs: Fix kernel address leakage
kernel: perf/x86/amd/brs: Fix kernel address leakage
A flaw was found in the Linux kernel. A local user can exploit a vulnerability in the `perf` subsystem on AMD processors utilizing the Branch Sampling (BRS) feature. This flaw occurs because the software filtering mechanism for branch records only validates the branch-to address, leaving the branch-from address unchecked. This oversight allows kernel addresses to be exposed to user space, leading to information disclosure.
Package: kernel (Red Hat Enterprise Linux 10) - Fix deferred
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affected
Package: kernel (Red Hat Enterprise Linux 8) - Fix deferred
Package:
Red Hat
kernel: octeontx2-af: Block VFs from clobbering special CGX PKIND state
vendor_redhat·2026-08-15·CVSS 8.8
CVE-2026-74527 [HIGH] CWE-1220 kernel: octeontx2-af: Block VFs from clobbering special CGX PKIND state
kernel: octeontx2-af: Block VFs from clobbering special CGX PKIND state
In the Linux kernel, the following vulnerability has been resolved:
octeontx2-af: Block VFs from clobbering special CGX PKIND state
PF and VF NIX LFs that share a CGX LMAC reuse the same hardware PKIND
programming. When HiGig2 or EDSA parsing is enabled, a VF NIX LF alloc must
not reset the LMAC RX PKIND or default TX parse config over the PF setup.
Add cgx_get_pkind() and rvu_cgx_is_pkind_config_permitted() so VFs skip
cgx_set_pkind(), rvu_npc_set_pkind(), and NIX_AF_LFX_TX_PARSE_CFG updates
when the LMAC is using NPC_RX_HIGIG_PKIND or NPC_RX_EDSA_PKIND.
A flaw was found in the Linux kernel's octeontx2-af driver. When Physical Functions (PFs) and Virtual Functions (VFs) share a network interface controller's (NIC) h
Red Hat
chromium-browser: chromium-browser: Insufficient policy enforcement in Passwords
vendor_redhat·2026-07-30·CVSS 8.1
CVE-2026-17825 [MEDIUM] CWE-1220 chromium-browser: chromium-browser: Insufficient policy enforcement in Passwords
chromium-browser: chromium-browser: Insufficient policy enforcement in Passwords
An insufficient policy enforcement flaw was found in the Passwords component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=517675979
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.
CISA
Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability
cisa·2026-07-14·CVSS 7.8
CVE-2026-56155 [HIGH] CWE-1220 Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability
Vulnerability: Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability
Affected: Microsoft Active Directory Federation Services
Microsoft Active Directory Federation Services contains an insufficient granularity of access control vulnerability that allows an authorized attacker to elevate privileges locally.
Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet
Red Hat
grafana: Grafana: Unauthorized public dashboard deletion across organizations
vendor_redhat·2026-07-07·CVSS 2.7
CVE-2026-28378 [LOW] CWE-1220 grafana: Grafana: Unauthorized public dashboard deletion across organizations
grafana: Grafana: Unauthorized public dashboard deletion across organizations
The public dashboard deletion endpoint does not enforce organization isolation, allowing an Org Admin in one organization to delete public dashboards belonging to a different organization by supplying the target dashboard's identifiers.
A flaw in Grafana's public dashboard deletion endpoint lacks organization isolation, allowing an Organization Administrator to delete public dashboards in other organizations using the target dashboard's ID.
Statement: This Low impact flaw in Grafana allows an authenticated Organization Administrator to delete public dashboards belonging to other organizations. This is due to insufficient isolation enforcement in the public dashboard deletion endpoint, potentially affecting the
Red Hat
keycloak-services: keycloak: FGAP v2 parent group children endpoint bypasses per-child view permission filter
vendor_redhat·2026-07-03·CVSS 4.3
CVE-2026-14615 [MEDIUM] CWE-1220 keycloak-services: keycloak: FGAP v2 parent group children endpoint bypasses per-child view permission filter
keycloak-services: keycloak: FGAP v2 parent group children endpoint bypasses per-child view permission filter
A flaw was found in the Fine-Grained Admin Permissions (FGAP) v2 implementation within Keycloak's administrative services. When FGAP v2 is enabled, the system fails to properly filter child groups based on the caller's specific permissions when requested through a parent group. This allows a delegated administrator to view details of child groups they are not authorized to access directly, including group names, paths, and custom attributes.
Statement: The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that it requires the attacker to possess a delegated administrator role with specific permissions. Successful exploitation allows
Red Hat
ImageMagick: ImageMagick: Unauthorized file access due to missing policy checks in concatenate operation
vendor_redhat·2026-07-01·CVSS 5.5
CVE-2026-55628 [MEDIUM] CWE-1220 ImageMagick: ImageMagick: Unauthorized file access due to missing policy checks in concatenate operation
ImageMagick: ImageMagick: Unauthorized file access due to missing policy checks in concatenate operation
In versions prior to 7.1.2-26he, the `-concatenate` operation is missing policy checks, potentially resulting in both reading and writing to paths disallowed by the security policy. This issue has been fixed in version 7.1.2-26.
A flaw was found in ImageMagick. The `-concatenate` operation, used for combining images, lacks proper security policy checks. This oversight could allow an attacker to read from or write to file paths that should otherwise be restricted by the security policy. This could lead to unauthorized access to sensitive system resources.
Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Se
Red Hat
chromium-browser: Policy bypass in Network
vendor_redhat·2026-06-30·CVSS 4.3
CVE-2026-14076 [MEDIUM] CWE-1220 chromium-browser: Policy bypass in Network
chromium-browser: Policy bypass in Network
Insufficient policy enforcement in Network in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium security severity: Low)
A policy bypass flaw was found in the Network component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=511815165
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.
Red Hat
chromium-browser: Insufficient policy enforcement in Extensions
vendor_redhat·2026-06-30·CVSS 4.3
CVE-2026-14047 [MEDIUM] CWE-1220 chromium-browser: Insufficient policy enforcement in Extensions
chromium-browser: Insufficient policy enforcement in Extensions
Insufficient policy enforcement in Extensions in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extension to bypass content security policy via a crafted Chrome Extension. (Chromium security severity: Low)
An insufficient policy enforcement flaw was found in the Extensions component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=498864176
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.
Red Hat
chromium-browser: chromium-browser: Race in V8
vendor_redhat·2026-06-10·CVSS 7.5
CVE-2026-1220 [HIGH] CWE-843 chromium-browser: chromium-browser: Race in V8
chromium-browser: chromium-browser: Race in V8
Race in V8 in Google Chrome prior to 144.0.7559.99 allowed a remote attacker to potentially exploit type confusion via a crafted HTML page. (Chromium security severity: High)
A race flaw was found in the V8 component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=473851441
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.
Red Hat
keycloak: Keycloak: Information disclosure due to user profile permission bypass
vendor_redhat·2026-06-05·CVSS 2.7
CVE-2026-9088 [LOW] CWE-1220 keycloak: Keycloak: Information disclosure due to user profile permission bypass
keycloak: Keycloak: Information disclosure due to user profile permission bypass
A flaw was found in org.keycloak.services. An administrator with delegated access to read group memberships and users can bypass user profile permissions by accessing the group members endpoint. This allows the administrator to view user attributes that are explicitly configured to be denied, leading to information disclosure.
Statement: Low: A flaw in Keycloak allows administrators with delegated access to read group memberships and users to bypass user profile permissions. This enables the viewing of user attributes that are configured to be denied, impacting data confidentiality for specific administrative roles.
Mitigation: Mitigation for this issue is either not available or the currently available opt
Red Hat
chromium-browser: Inappropriate implementation in Browser
vendor_redhat·2026-06-02·CVSS 4.3
CVE-2026-11257 [MEDIUM] CWE-1220 chromium-browser: Inappropriate implementation in Browser
chromium-browser: Inappropriate implementation in Browser
Inappropriate implementation in Browser in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)
An inappropriate implementation flaw was found in the Browser component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=499051898
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.
Red Hat
kernel: net: libwx: fix VF illegal register access
vendor_redhat·2026-05-28
CVE-2026-46142 CWE-1220 kernel: net: libwx: fix VF illegal register access
kernel: net: libwx: fix VF illegal register access
A flaw was found in the Linux kernel's `libwx` network driver. When a Virtual Function (VF) is initialized, it attempts to read a Physical Function (PF) restricted register, `WX_CFG_PORT_ST`. This illegal register access can lead to a system hang, resulting in a Denial of Service (DoS).
Package: kernel (Red Hat Enterprise Linux 10) - Not affected
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affected
Package: kernel (Red Hat Enterprise Linux 8) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 8) - Not affected
Package: kernel (Red Hat Enterprise Linux 9) - Not affected
Package: kernel-rt (Red H
Red Hat
keycloak: org.keycloak.authorization: Keycloak: Information disclosure via broken access control in user lookup endpoint
vendor_redhat·2026-05-19·CVSS 4.3
CVE-2026-37981 [MEDIUM] CWE-1220 keycloak: org.keycloak.authorization: Keycloak: Information disclosure via broken access control in user lookup endpoint
keycloak: org.keycloak.authorization: Keycloak: Information disclosure via broken access control in user lookup endpoint
A flaw was found in Keycloak. A broken access control vulnerability in the Account Resources user lookup endpoint allows a remote authenticated user, who owns at least one User-Managed Access (UMA) resource, to enumerate and harvest personally identifiable information (PII) for all realm users. By sending crafted requests with arbitrary usernames or email values, the endpoint returns full profile objects for unrelated users. This leads to broad profile-level information disclosure.
Statement: Moderate: This vulnerability in Red Hat Build of Keycloak (RHBK) allows an authenticated user to bypass access controls in the Account Resources user lookup endpoint. By sending c
Red Hat
chromium-browser: chromium-browser: Insufficient policy enforcement in Payments
vendor_redhat·2026-05-14·CVSS 4.3
CVE-2026-8566 [MEDIUM] CWE-1220 chromium-browser: chromium-browser: Insufficient policy enforcement in Payments
chromium-browser: chromium-browser: Insufficient policy enforcement in Payments
Insufficient policy enforcement in Payments in Google Chrome on Android prior to 148.0.7778.168 allowed a remote attacker to bypass discretionary access control via a crafted HTML page. (Chromium security severity: Medium)
An insufficient policy enforcement flaw was found in the Payments component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=470646792
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.
Red Hat
grafana: Grafana: Unauthorized annotation deletion by editor users
vendor_redhat·2026-05-13·CVSS 4.3
CVE-2026-28374 [MEDIUM] CWE-1220 grafana: Grafana: Unauthorized annotation deletion by editor users
grafana: Grafana: Unauthorized annotation deletion by editor users
A flaw was found in Grafana. An authenticated editor user could exploit this vulnerability to delete any annotation, even those for which they lack read permissions. This unauthorized action compromises the integrity of data by allowing deletion of information beyond their intended access scope.
Package: multicluster-globalhub/multicluster-globalhub-grafana-rhel9 (Multicluster Global Hub) - Fix deferred
Package: rhacm2/acm-grafana-rhel9 (Red Hat Advanced Cluster Management for Kubernetes 2) - Fix deferred
Package: rhceph/rhceph-5-dashboard-rhel8 (Red Hat Ceph Storage 5) - Not affected
Package: rhceph/rhceph-6-dashboard-rhel9 (Red Hat Ceph Storage 6) - Not affected
Package: rhceph/grafana-rhel9 (Red Hat Ceph Storage 8)
Red Hat
kernel: nsfs: tighten permission checks for handle opening
vendor_redhat·2026-05-08
CVE-2026-43391 CWE-1220 kernel: nsfs: tighten permission checks for handle opening
kernel: nsfs: tighten permission checks for handle opening
A flaw was found in the Linux kernel's nsfs component. This vulnerability allows privileged services to potentially view the namespaces of other privileged services, leading to information disclosure. This could enable unauthorized access to sensitive data or configurations between isolated services.
Package: kernel (Red Hat Enterprise Linux 10) - Not affected
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affected
Package: kernel (Red Hat Enterprise Linux 8) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 8) - Not affected
Package: kernel (Red Hat Enterprise Linux 9) - Not affected
Pac
Red Hat
chromium-browser: Insufficient policy enforcement in DirectSockets
vendor_redhat·2026-05-05·CVSS 7.3
CVE-2026-7962 [MEDIUM] CWE-1220 chromium-browser: Insufficient policy enforcement in DirectSockets
chromium-browser: Insufficient policy enforcement in DirectSockets
An insufficient policy enforcement flaw was found in the DirectSockets component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=497081987
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.
Red Hat
axios: Axios: Information disclosure due to `no_proxy` bypass
vendor_redhat·2026-04-24·CVSS 6.8
CVE-2026-42038 [MEDIUM] CWE-1220 axios: Axios: Information disclosure due to `no_proxy` bypass
axios: Axios: Information disclosure due to `no_proxy` bypass
A flaw was found in Axios, a software library used for making web requests. This vulnerability allows an attacker to bypass the `no_proxy` configuration, which is designed to prevent certain internal network requests from being sent through an external proxy. Specifically, when `no_proxy=localhost` is set, requests intended for local system addresses (such as 127.0.0.1 and [::1]) are still routed through the proxy. This could lead to unintended exposure of internal network traffic or sensitive information.
Mitigation: To mitigate this issue, explicitly include `127.0.0.1` and `[::1]` in the `no_proxy` environment variable or application-specific proxy bypass configuration. This ensures that requests to these loopback addresses
CISA
Microsoft Defender Insufficient Granularity of Access Control Vulnerability
cisa·2026-04-22·CVSS 7.8
CVE-2026-33825 [HIGH] CWE-1220 Microsoft Defender Insufficient Granularity of Access Control Vulnerability
Vulnerability: Microsoft Defender Insufficient Granularity of Access Control Vulnerability
Affected: Microsoft Defender
Microsoft Defender contains an insufficient granularity of access control vulnerability that could allow an authorized attacker to escalate privileges locally.
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Notes: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33825 ; https://nvd.nist.gov/vuln/detail/CVE-2026-33825
Remediation Due Date: 2026-05-06
Red Hat
argocd-image-updater: ArgoCD Image Updater: Cross-Namespace Privilege Escalation via insufficient namespace validation
vendor_redhat·2026-04-15·CVSS 9.1
CVE-2026-6388 [CRITICAL] CWE-1220 argocd-image-updater: ArgoCD Image Updater: Cross-Namespace Privilege Escalation via insufficient namespace validation
argocd-image-updater: ArgoCD Image Updater: Cross-Namespace Privilege Escalation via insufficient namespace validation
A flaw was found in ArgoCD Image Updater. This vulnerability allows an attacker, with permissions to create or modify an ImageUpdater resource in a multi-tenant environment, to bypass namespace boundaries. By exploiting insufficient validation, the attacker can trigger unauthorized image updates on applications managed by other tenants. This leads to cross-namespace privilege escalation, impacting application integrity through unauthorized application updates.
Statement: Critical: A cross-namespace privilege escalation flaw in Argo CD Image Updater, a component of Red Hat OpenShift GitOps, allows an attacker with permissions to create or modify `ImageUpdater` resources t
Red Hat
Vite: Vite: Information disclosure via WebSocket connection bypasses access control
vendor_redhat·2026-04-07·CVSS 8.2
CVE-2026-39363 [HIGH] CWE-1220 Vite: Vite: Information disclosure via WebSocket connection bypasses access control
Vite: Vite: Information disclosure via WebSocket connection bypasses access control
Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, if it is possible to connect to the Vite dev server’s WebSocket without an Origin header, an attacker can invoke fetchModule via the custom WebSocket event vite:invoke and combine file://... with ?raw (or ?inline) to retrieve the contents of arbitrary files on the server as a JavaScript string (e.g., export default "..."). The access control enforced in the HTTP request path (such as server.fs.allow) is not applied to this WebSocket-based execution path. This vulnerability is fixed in 6.4.2, 7.3.2, and 8.0.5.
A flaw was found in Vite, a frontend tooling framework. A remote attacker can exploit this vulnerabi
Red Hat
kernel: drm/xe: Open-code GGTT MMIO access protection
vendor_redhat·2026-04-03·CVSS 5.5
CVE-2026-23466 [MEDIUM] CWE-1220 kernel: drm/xe: Open-code GGTT MMIO access protection
kernel: drm/xe: Open-code GGTT MMIO access protection
In the Linux kernel, the following vulnerability has been resolved:
drm/xe: Open-code GGTT MMIO access protection
GGTT MMIO access is currently protected by hotplug (drm_dev_enter),
which works correctly when the driver loads successfully and is later
unbound or unloaded. However, if driver load fails, this protection is
insufficient because drm_dev_unplug() is never called.
Additionally, devm release functions cannot guarantee that all BOs with
GGTT mappings are destroyed before the GGTT MMIO region is removed, as
some BOs may be freed asynchronously by worker threads.
To address this, introduce an open-coded flag, protected by the GGTT
lock, that guards GGTT MMIO access. The flag is cleared during the
dev_fini_ggtt devm release funct
Red Hat
github.com/nats-io/nats-server: NATS-Server: Unauthorized trace message redirection via message tracing headers
vendor_redhat·2026-03-25·CVSS 4.3
CVE-2026-33249 [MEDIUM] CWE-1220 github.com/nats-io/nats-server: NATS-Server: Unauthorized trace message redirection via message tracing headers
github.com/nats-io/nats-server: NATS-Server: Unauthorized trace message redirection via message tracing headers
NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Starting in version 2.11.0 and prior to versions 2.11.15 and 2.12.6, a valid client which uses message tracing headers can indicate that the trace messages can be sent to an arbitrary valid subject, including those to which the client does not have publish permission. The payload is a valid trace message and not chosen by the attacker. Versions 2.11.15 and 2.12.6 contain a fix. No known workarounds are available.
A flaw was found in NATS-Server. A valid client can exploit this flaw by manipulating message tracing headers to redirect trace messages to any valid subject, even those for
Cisco
Cisco Application Policy Infrastructure Controller Denial of Service Vulnerability
vendor_cisco·2026-02-25·CVSS 5.5
CVE-2026-20107 [MEDIUM] CWE-1220 Cisco Application Policy Infrastructure Controller Denial of Service Vulnerability
Cisco Application Policy Infrastructure Controller Denial of Service Vulnerability
A vulnerability in the Object Model CLI component of Cisco Application Policy Infrastructure Controller (APIC) could allow an authenticated, local attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition. To exploit this vulnerability, the attacker must have valid user credentials and any role that includes CLI access.
This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by issuing crafted commands at the CLI prompt. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition.
Cisco has released software updates that address this vulnerability. There are no
Red Hat
vaultwarden: Vaultwarden: Information disclosure due to bypassed collection permissions
vendor_redhat·2026-02-11·CVSS 6.5
CVE-2026-26012 [MEDIUM] CWE-1220 vaultwarden: Vaultwarden: Information disclosure due to bypassed collection permissions
vaultwarden: Vaultwarden: Information disclosure due to bypassed collection permissions
vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Prior to 1.35.3, a regular organization member can retrieve all ciphers within an organization, regardless of collection permissions. The endpoint /ciphers/organization-details is accessible to any organization member and internally uses Cipher::find_by_org to retrieve all ciphers. These ciphers are returned with CipherSyncType::Organization without enforcing collection-level access control. This vulnerability is fixed in 1.35.3.
A flaw was found in vaultwarden, an unofficial Bitwarden compatible server. A regular organization member can retrieve all ciphers (encrypted data) within an organization
Chrome
Stable Channel Update for Desktop: CVE-2026-1220
vendor_chrome·2026-01-20
CVE-2026-1220 [HIGH] Stable Channel Update for Desktop: CVE-2026-1220
Stable Channel Update for Desktop
CVE-2026-1220: Race in V8. Reported by @p1nky4745 on 2026-01-07 We would also like to thank all security researchers that worked with us during the development cycle to prevent security bugs from ever reaching the stable channel
Severity: high
Microsoft
Chromium: CVE-2026-1220 Race in V8
vendor_msrc·2026-01-13
CVE-2026-1220 Chromium: CVE-2026-1220 Race in V8
Chromium: CVE-2026-1220 Race in V8
Description: This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.
FAQ: What is the version information for this release?
Microsoft Edge Version
Date Released
Based on Chromium Version
144.0.3719.92
01/23/2026
144.0.7559.96/.97
FAQ: Why is this Chrome CVE included in the Security Update Guide?
The vulnerability assigned to this CVE is in Chromium Open Source Software (OSS) which is consumed by Microsoft Edge (Chromium-based). It is being documented in the Security Update Guide to announce that the latest version of Microsoft Edge (Chromium-based) is no longer vulnerable.
How can I see the version of the browser?
In your Microso
Debian
CVE-2026-1220: chromium
vendor_debian·2026
CVE-2026-1220 CVE-2026-1220: chromium
bookworm: resolved (fixed in 144.0.7559.96-1~deb12u1)
bullseye: open
forky: resolved (fixed in 144.0.7559.96-1)
sid: resolved (fixed in 144.0.7559.96-1)
trixie: resolved (fixed in 144.0.7559.96-1~deb13u1)
No detection rules found.
No public exploits indexed.
Wiz
CVE-2026-1220 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz
CVE-2026-1220 CVE-2026-1220 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-1220 :
vulnerability analysis and mitigation
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.
Source : NVD
Published January 23, 2026
CNA Score N/A
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) N/A
Exploitation Probability (EPSS) N/A
Affected packages and libraries
cef
chromium-headless-debuginfo
Sources
NVD
Alpine 3.23 Has Fix Added at: Feb 01, 2026
Alpine edge Has Fix Added at: Jan 31, 2026
Debian 11 No Fix Added at: Jan 22, 2026
Debian 12, 13, 14 Has Fix Added at: Jan 22, 2026
Echo Has Fix Added at: Jan 21, 2026
## Get a CVE risk assessmen
Bugzilla
CVE-2026-64512 kernel: ACPI: CPPC: Suppress UBSAN warning caused by field misuse
bugzilla·2026-07-25
CVE-2026-64512 [LOW] CVE-2026-64512 kernel: ACPI: CPPC: Suppress UBSAN warning caused by field misuse
CVE-2026-64512 kernel: ACPI: CPPC: Suppress UBSAN warning caused by field misuse
In the Linux kernel, the following vulnerability has been resolved:
ACPI: CPPC: Suppress UBSAN warning caused by field misuse
The definition of reg->access_width changes depending on the
reg->space_id type. Type ACPI_ADR_SPACE_PLATFORM_COMM uses
access_width to indicate the PCC region, which can result in a UBSAN
if the value is greater than 4.
For example:
UBSAN: shift-out-of-bounds in drivers/acpi/cppc_acpi.c:1090:9
shift exponent 32 is too large for 32-bit type 'int'
CPU: 61 UID: 0 PID: 1220 Comm: (udev-worker) Not tainted 7.0.10-201.fc44.aarch64 #1 PREEMPT(lazy)
Hardware name: To be filled by O.E.M.
Call trace:
...(trimming)
ubsan_epilogue+0x10/0x48
__ubsan_handle_shift_out_of_bounds+0xdc/0x1e0
cpc_wr
Bugzilla
CVE-2026-1220 chromium: chromium-browser: Race in V8 [epel-all]
bugzilla·2026-06-22·CVSS 7.5
CVE-2026-1220 [HIGH] CVE-2026-1220 chromium: chromium-browser: Race in V8 [epel-all]
CVE-2026-1220 chromium: chromium-browser: Race in V8 [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
It's fixed in 149.0.7827.155
Bugzilla
CVE-2026-1220 chromium: chromium-browser: Race in V8 [fedora-all]
bugzilla·2026-06-22·CVSS 7.5
CVE-2026-1220 [HIGH] CVE-2026-1220 chromium: chromium-browser: Race in V8 [fedora-all]
CVE-2026-1220 chromium: chromium-browser: Race in V8 [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
It's fixed in 149.0.7827.155
Bugzilla
CVE-2026-1220 chromium-browser: chromium-browser: Race in V8
bugzilla·2026-06-10·CVSS 7.5
CVE-2026-1220 [HIGH] CVE-2026-1220 chromium-browser: chromium-browser: Race in V8
CVE-2026-1220 chromium-browser: chromium-browser: Race in V8
Race in V8 in Google Chrome prior to 144.0.7559.99 allowed a remote attacker to potentially exploit type confusion via a crafted HTML page. (Chromium security severity: High)
2026-06-10
Published