CVE-2026-8037
published 2026-06-04CVE-2026-8037: OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on…
PriorityP199critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
KEVITWEXPLOITInitial access
CISA Known Exploited Vulnerabilitydue 2026-08-10
Exploited in the wild
EPSS
77.36%
99.6th percentile
OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| progress | connection_manager_for_objectscale | < 7.2.63.2 | 7.2.63.2 |
| progress | ecs_connection_manager | < 7.2.63.2 | 7.2.63.2 |
| progress | loadmaster | < 7.2.54.18 | 7.2.54.18 |
| progress | loadmaster | >= 7.2.55.0 < 7.2.63.2 | 7.2.63.2 |
| progress | moveit_web_application_firewall | < 7.2.63.2 | 7.2.63.2 |
| progress_software | ecs_connections_manager | >= V7.2.60.0 < V7.2.63.2 | V7.2.63.2 |
| progress_software | loadmaster | >= V7.2.54.12 < V7.2.54.18 | V7.2.54.18 |
| progress_software | loadmaster | >= V7.2.60.0 < V7.2.63.2 | V7.2.63.2 |
| progress_software | moveit_waf | >= V7.2.60.0 < V7.2.63.2 | V7.2.63.2 |
| progress_software | object_scale_connection_manager | >= V7.2.60.0 < V7.2.63.2 | V7.2.63.2 |
Detection & IOCsextracted from sources · hover to see the quote
commandPOST /accessv2 HTTP/1.1
Content-Type: application/json
{"cmd": "getall", "apiuser": "''''", "apipass": "BBBBB", "g0": "AAAAAAAAAAAAAAAA'; cat /etc/passwd #", ...}↗
snort↗
Progress Kemp LoadMaster Commad Injection (CVE-2024-1212, CVE-2026-8037)
- →Monitor for unauthenticated POST requests to the /accessv2 endpoint containing JSON bodies with a large number of extra key-value pairs (e.g., g0–g60) alongside an 'apiuser' field containing multiple single quotes (e.g., "''''"). This is the heap-spray pattern used to trigger the out-of-bounds read into adjacent heap memory. ↗
- →Alert on POST /accessv2 requests where the JSON body contains shell metacharacters such as single quotes and semicolons in non-standard fields (e.g., values matching pattern: AAAA...'; <command> #), indicative of command injection payload spraying. ↗
- →Exploitation activity commenced on June 29, 2026, coinciding with the public release of the watchTowr Labs PoC. Treat any POST to /accessv2 from external IPs after this date with elevated suspicion, especially from the three known attacker IPs. ↗
- →The exploit response contains 'root:x:0:0:' in the body (from /etc/passwd read) with Content-Type: text/json and HTTP 200. Use this as a detection matcher for successful exploitation confirmation in HTTP response logs. ↗
- →The vulnerable function is escape_quotes(). Look for crash/error logs or anomalous heap behavior in LoadMaster process logs referencing this function, which may indicate exploitation attempts even if they fail. ↗
- →Use the FOFA fingerprint query (body="Progress" && icon_hash=="-2107233094") to identify internet-exposed LoadMaster appliances that may be targeted. ↗
- ·The vulnerability only affects LoadMaster appliances with the API enabled. Appliances with the API disabled are not exploitable via this vector. ↗
- ·Observed exploitation attempts from the three known IPs all ended in failure with no post-compromise activity, but a public PoC is available and further attempts are expected. ↗
- ·Fixed versions are GA v7.2.63.2 and LTSF v7.2.54.18. Detection rules targeting the /accessv2 endpoint should be retired or adjusted after patching, but network-level blocking of the known attacker IPs remains advisable. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vulncheck9.6CRITICAL
cisa7.5HIGH
vendor_redhat9.6CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Progress LoadMaster API command injection
vuldb·2026-06-04·CVSS 9.6
CVE-2026-8037 [CRITICAL] Progress LoadMaster API command injection
A vulnerability was found in Progress LoadMaster, ECS Connections Manager, Object Scale Connection Manager and MOVEit WAF. It has been classified as critical. The impacted element is an unknown function of the component API. Performing a manipulation results in command injection.
This vulnerability is identified as CVE-2026-8037. The attack can only be performed from the local network. There is not any exploit available.
Upgrading the affected component is recommended.
GHSA
OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting uns
ghsa_unreviewed·2026-06-04
CVE-2026-8037 [CRITICAL] CWE-77 OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting uns
OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints
VulnCheck
Progress loadmaster Improper Neutralization of Special Elements used in a Command ('Command Injection')
vulncheck·2026·CVSS 9.6
CVE-2026-8037 [CRITICAL] Progress loadmaster Improper Neutralization of Special Elements used in a Command ('Command Injection')
Progress loadmaster Improper Neutralization of Special Elements used in a Command ('Command Injection')
OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints
Affected: Progress loadmaster
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://kevintel.com/CVE-2026-8037
Red Hat
chromium-browser: Integer overflow in Compositing
vendor_redhat·2026-10-02·CVSS 4.3
CVE-2026-103621 [MEDIUM] CWE-190 chromium-browser: Integer overflow in Compositing
chromium-browser: Integer overflow in Compositing
Integer overflow in Compositing in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
An integer overflow flaw was found in the Compositing component of the Chromium browser.
Upstream bug(s):
https://issues.chromium.org/issues/556268833
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.
Red Hat
chromium-browser: Incorrect authorization in FileSystem
vendor_redhat·2026-10-02·CVSS 9.6
CVE-2026-103626 [CRITICAL] CWE-863 chromium-browser: Incorrect authorization in FileSystem
chromium-browser: Incorrect authorization in FileSystem
Incorrect authorization in FileSystem in Google Chrome on on Windows prior to 154.0.8037.97 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
An incorrect authorization flaw was found in the FileSystem component of the Chromium browser.
Upstream bug(s):
https://issues.chromium.org/issues/553114097
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.
Red Hat
chromium-browser: Use after free in Contextual Tasks
vendor_redhat·2026-10-02·CVSS 8.3
CVE-2026-103624 [HIGH] CWE-416 chromium-browser: Use after free in Contextual Tasks
chromium-browser: Use after free in Contextual Tasks
Use after free in Contextual Tasks in Google Chrome on on Windows prior to 154.0.8037.97 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
An use after free flaw was found in the Contextual Tasks component of the Chromium browser.
Upstream bug(s):
https://issues.chromium.org/issues/561660166
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.
Red Hat
chromium-browser: Externally controlled reference in DevTools
vendor_redhat·2026-09-29·CVSS 8.0
CVE-2026-95376 [HIGH] CWE-610 chromium-browser: Externally controlled reference in DevTools
chromium-browser: Externally controlled reference in DevTools
Externally controlled reference in DevTools in Google Chrome prior to 154.0.8037.57 allowed an adjacent attacker leveraging social engineering to bypass system access restrictions via crafted network traffic. (Chromium security severity: Medium)
An externally controlled reference flaw was found in the DevTools component of the Chromium browser.
Upstream bug(s):
https://issues.chromium.org/issues/513134076
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.
Red Hat
chromium-browser: Missing authorization in WakeLock
vendor_redhat·2026-09-29·CVSS 8.4
CVE-2026-95278 [HIGH] CWE-862 chromium-browser: Missing authorization in WakeLock
chromium-browser: Missing authorization in WakeLock
Missing authorization in WakeLock in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)
A missing authorization flaw was found in the WakeLock component of the Chromium browser.
Upstream bug(s):
https://issues.chromium.org/issues/497344014
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.
Red Hat
chromium-browser: Cross-site request forgery in DevTools
vendor_redhat·2026-09-29·CVSS 8.8
CVE-2026-95362 [HIGH] CWE-352 chromium-browser: Cross-site request forgery in DevTools
chromium-browser: Cross-site request forgery in DevTools
Cross-site request forgery in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
A cross-site request forgery flaw was found in the DevTools component of the Chromium browser.
Upstream bug(s):
https://issues.chromium.org/issues/511791538
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.
Red Hat
chromium-browser: chromium-browser: Type confusion in V8
vendor_redhat·2026-09-29·CVSS 8.8
CVE-2026-102328 [HIGH] CWE-843 chromium-browser: chromium-browser: Type confusion in V8
chromium-browser: chromium-browser: Type confusion in V8
Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
A type confusion flaw was found in the V8 component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=560536732
https://code.google.com/p/chromium/issues/detail?id=102328
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.
Red Hat
chromium-browser: chromium-browser: Use after free in AdFilter
vendor_redhat·2026-09-29·CVSS 9.6
CVE-2026-95310 [CRITICAL] CWE-825 chromium-browser: chromium-browser: Use after free in AdFilter
chromium-browser: chromium-browser: Use after free in AdFilter
Use after free in AdFilter in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
An use after free flaw was found in the AdFilter component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=562151598
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.
Red Hat
chromium-browser: Use after free in Fullscreen
vendor_redhat·2026-09-29·CVSS 9.6
CVE-2026-95313 [CRITICAL] CWE-416 chromium-browser: Use after free in Fullscreen
chromium-browser: Use after free in Fullscreen
Use after free in Fullscreen in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
An use after free flaw was found in the Fullscreen component of the Chromium browser.
Upstream bug(s):
https://issues.chromium.org/issues/552665794
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.
Red Hat
chromium-browser: chromium-browser: Use after free in Bluetooth
vendor_redhat·2026-09-29·CVSS 9.6
CVE-2026-102306 [CRITICAL] CWE-825 chromium-browser: chromium-browser: Use after free in Bluetooth
chromium-browser: chromium-browser: Use after free in Bluetooth
Use after free in Bluetooth in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
An use after free flaw was found in the Bluetooth component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=556926296
https://code.google.com/p/chromium/issues/detail?id=102306
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.
Red Hat
chromium-browser: chromium-browser: Uninitialized resource in Skia
vendor_redhat·2026-09-29·CVSS 4.3
CVE-2026-102325 [MEDIUM] CWE-908 chromium-browser: chromium-browser: Uninitialized resource in Skia
chromium-browser: chromium-browser: Uninitialized resource in Skia
Uninitialized resource in Skia in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)
An uninitialized resource flaw was found in the Skia component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=561994362
https://code.google.com/p/chromium/issues/detail?id=102325
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.
Red Hat
chromium-browser: Use after free in Browser
vendor_redhat·2026-09-29·CVSS 7.8
CVE-2026-95298 [HIGH] CWE-416 chromium-browser: Use after free in Browser
chromium-browser: Use after free in Browser
Use after free in Browser in Google Chrome prior to 154.0.8037.57 allowed a local attacker to potentially execute arbitrary code outside the sandbox via UI Interaction. (Chromium security severity: High)
An use after free flaw was found in the Browser component of the Chromium browser.
Upstream bug(s):
https://issues.chromium.org/issues/520516206
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.
Red Hat
chromium-browser: Missing authorization in Navigation
vendor_redhat·2026-09-29·CVSS 5.4
CVE-2026-95287 [MEDIUM] CWE-862 chromium-browser: Missing authorization in Navigation
chromium-browser: Missing authorization in Navigation
Missing authorization in Navigation in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)
A missing authorization flaw was found in the Navigation component of the Chromium browser.
Upstream bug(s):
https://issues.chromium.org/issues/495529018
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.
Red Hat
chromium-browser: Race condition in Editing
vendor_redhat·2026-09-29·CVSS 5.3
CVE-2026-95360 [MEDIUM] CWE-367 chromium-browser: Race condition in Editing
chromium-browser: Race condition in Editing
Race condition in Editing in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
A race condition flaw was found in the Editing component of the Chromium browser.
Upstream bug(s):
https://issues.chromium.org/issues/517584808
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.
CISA
Progress LoadMaster Command Injection Vulnerability
cisa·2026-08-07·CVSS 7.5
CVE-2026-8037 [HIGH] CWE-77 Progress LoadMaster Command Injection Vulnerability
Vulnerability: Progress LoadMaster Command Injection Vulnerability
Affected: Progress LoadMaster
Progress LoadMaster contains a command injection vulnerability that allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints.
Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to B
No detection rules found.
Nuclei
Progress ADC LoadMaster - Command Injection
nuclei·CVSS 7.5
CVE-2026-8037 [HIGH] Progress ADC LoadMaster - Command Injection
Progress ADC LoadMaster - Command Injection
OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints
Template:
id: CVE-2026-8037
info:
name: Progress ADC LoadMaster - Command Injection
author: watchtowr,DhiyaneshDk
severity: critical
description: |
OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints
impact: |
Unauthenticated attackers can execute arbitrary commands on the LoadMaster appliance, potentially leadin
Hackernews
Progress Kemp LoadMaster Flaw Hits CISA KEV After 792 Reported Exploit Attempts
blogs_hackernews·2026-08-08·CVSS 9.8
CVE-2026-8037 [CRITICAL] Progress Kemp LoadMaster Flaw Hits CISA KEV After 792 Reported Exploit Attempts
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Progress Kemp LoadMaster Flaw Hits CISA KEV After 792 Reported Exploit Attempts
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added a critical-severity security flaw impacting Progress Kemp LoadMaster to its Known Exploited Vulnerabilities (KEV) catalog, following reports of active exploitation in the wild.
The vulnerability, tracked as CVE-2026-8037 (CVSS score: 9.6), is a command injection flaw that could be weaponized to achieve arbitrary code execution on susceptible devices.
"Progress LoadMaster contains a command injection vulnerability that allows an un-authenticated attacker to execute a
Hackernews
⚡ Weekly Recap: Proxy Botnets, Browser Ransomware, AI Agent Tricks, Fake PoC Malware and More
blogs_hackernews·2026-07-06
CVE-2026-48276 ⚡ Weekly Recap: Proxy Botnets, Browser Ransomware, AI Agent Tricks, Fake PoC Malware and More
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ⚡ Weekly Recap: Proxy Botnets, Browser Ransomware, AI Agent Tricks, Fake PoC Malware and More
A streaming box should not need a threat model. Neither should a username field, a demo repo, a reset flow, or a browser permission prompt. That is the irritating part this week: the risky pieces were ordinary.
Home devices became a routing cover. Clean code pulled dirt from a dependency. Identity shortcuts aged badly. AI systems trusted the wrong instructions. Same soft spot throughout: trust placed one layer too early.
Below is the full recap, since this is apparently what counted as a normal week.
## ⚡ Threat of the Week
Net
Checkpoint
6th July – Threat Intelligence Report
blogs_checkpoint·2026-07-06
CVE-2026-46817 6th July – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 6th July – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 6th July, please download our Threat Intelligence Bulletin.
TOP ATTACKS AND BREACHES
River Bank & Trust, a US financial institution, has experienced a ransomware incident after an unauthorized actor accessed the network of parent company River Financial Corporation on June 16. The bank found ransomware on portions of its server environment and is assessing whether personal data was accessed or exfiltrated.
Indra
Hackernews
Progress Kemp LoadMaster Pre-Auth RCE Flaw Faces Active Exploitation Attempts
blogs_hackernews·2026-07-01·CVSS 9.6
CVE-2026-8037 [CRITICAL] Progress Kemp LoadMaster Pre-Auth RCE Flaw Faces Active Exploitation Attempts
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Progress Kemp LoadMaster Pre-Auth RCE Flaw Faces Active Exploitation Attempts
A recently disclosed critical security flaw impacting Progress Kemp LoadMaster is seeing active exploitation attempts, according to an advisory from eSentire's Threat Response Unit (TRU).
The Canadian cybersecurity company said it identified exploitation attempts targeting CVE-2026-8037 (CVSS score: 9.6), an operating system (OS) command injection flaw that could be exploited to achieve arbitrary code execution on susceptible devices. The exploitation activity commenced on June 29, 2026.
"OS Command Injection Remote Code Execution Vulnerability in
Hackernews
Progress Kemp LoadMaster Flaw Could Let Attackers Run Root Commands Pre-Auth
blogs_hackernews·2026-06-30·CVSS 9.6
CVE-2026-8037 [CRITICAL] Progress Kemp LoadMaster Flaw Could Let Attackers Run Root Commands Pre-Auth
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Progress Kemp LoadMaster Flaw Could Let Attackers Run Root Commands Pre-Auth
A critical vulnerability in Progress Kemp LoadMaster can let an unauthenticated attacker execute arbitrary commands as root on the appliance by sending a crafted request to its API.
The flaw, tracked as CVE-2026-8037 , carries a CVSS score of 9.8 according to ZDI . A patch is available. If you run LoadMaster with the API enabled, update now.
Progress published its advisory on June 4 and says it has not received any reports of exploitation. On June 29, researchers at watchTowr Labs published a detailed technical write-up that walks through the full
Bugzilla
CVE-2026-102323 chromium-browser: chromium-browser: Type confusion in V8
bugzilla·2026-09-29·CVSS 8.8
CVE-2026-102323 [HIGH] CVE-2026-102323 chromium-browser: chromium-browser: Type confusion in V8
CVE-2026-102323 chromium-browser: chromium-browser: Type confusion in V8
Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Bugzilla
CVE-2026-95349 chromium-browser: chromium-browser: Arbitrary code execution via crafted HTML page in WebGL
bugzilla·2026-09-29·CVSS 9.6
CVE-2026-95349 [CRITICAL] CVE-2026-95349 chromium-browser: chromium-browser: Arbitrary code execution via crafted HTML page in WebGL
CVE-2026-95349 chromium-browser: chromium-browser: Arbitrary code execution via crafted HTML page in WebGL
Buffer overflow in WebGL in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
Bugzilla
CVE-2026-102307 chromium-browser: chromium-browser: information disclosure via crafted HTML page
bugzilla·2026-09-29·CVSS 4.7
CVE-2026-102307 [MEDIUM] CVE-2026-102307 chromium-browser: chromium-browser: information disclosure via crafted HTML page
CVE-2026-102307 chromium-browser: chromium-browser: information disclosure via crafted HTML page
Uninitialized resource in Dawn in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Bugzilla
CVE-2026-102304 chromium-browser: chromium-browser: Use after free in Passwords
bugzilla·2026-09-29·CVSS 9.6
CVE-2026-102304 [CRITICAL] CVE-2026-102304 chromium-browser: chromium-browser: Use after free in Passwords
CVE-2026-102304 chromium-browser: chromium-browser: Use after free in Passwords
Use after free in Passwords in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Bugzilla
CVE-2026-95381 chromium-browser: Improper input validation in Printing
bugzilla·2026-09-29·CVSS 8.3
CVE-2026-95381 [HIGH] CVE-2026-95381 chromium-browser: Improper input validation in Printing
CVE-2026-95381 chromium-browser: Improper input validation in Printing
Improper input validation in Printing in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Bugzilla
CVE-2026-95364 chromium-browser: chromium-browser: User interface spoofing via crafted HTML page
bugzilla·2026-09-29·CVSS 5.4
CVE-2026-95364 [MEDIUM] CVE-2026-95364 chromium-browser: chromium-browser: User interface spoofing via crafted HTML page
CVE-2026-95364 chromium-browser: chromium-browser: User interface spoofing via crafted HTML page
Improper input validation in Passwords in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)
Bugzilla
CVE-2026-102306 chromium-browser: chromium-browser: Arbitrary code execution in Bluetooth via crafted HTML page
bugzilla·2026-09-29·CVSS 9.6
CVE-2026-102306 [CRITICAL] CVE-2026-102306 chromium-browser: chromium-browser: Arbitrary code execution in Bluetooth via crafted HTML page
CVE-2026-102306 chromium-browser: chromium-browser: Arbitrary code execution in Bluetooth via crafted HTML page
Use after free in Bluetooth in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Bugzilla
CVE-2026-95290 chromium-browser: chromium-browser: System access restriction bypass via missing authorization in NFC
bugzilla·2026-09-29·CVSS 5.4
CVE-2026-95290 [MEDIUM] CVE-2026-95290 chromium-browser: chromium-browser: System access restriction bypass via missing authorization in NFC
CVE-2026-95290 chromium-browser: chromium-browser: System access restriction bypass via missing authorization in NFC
Missing authorization in NFC in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
Bugzilla
CVE-2026-95354 chromium-browser: chromium-browser: Use after free in Verifier
bugzilla·2026-09-29·CVSS 8.3
CVE-2026-95354 [HIGH] CVE-2026-95354 chromium-browser: chromium-browser: Use after free in Verifier
CVE-2026-95354 chromium-browser: chromium-browser: Use after free in Verifier
Use after free in Verifier in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Medium)
Bugzilla
CVE-2026-95361 chromium-browser: chromium-browser: Web origin policy bypass via crafted HTML page
bugzilla·2026-09-29·CVSS 4.3
CVE-2026-95361 [MEDIUM] CVE-2026-95361 chromium-browser: chromium-browser: Web origin policy bypass via crafted HTML page
CVE-2026-95361 chromium-browser: chromium-browser: Web origin policy bypass via crafted HTML page
Confused deputy in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)
Bugzilla
CVE-2026-95331 chromium-browser: chromium-browser: arbitrary code execution via out-of-bounds write in ANGLE
bugzilla·2026-09-29·CVSS 9.6
CVE-2026-95331 [CRITICAL] CVE-2026-95331 chromium-browser: chromium-browser: arbitrary code execution via out-of-bounds write in ANGLE
CVE-2026-95331 chromium-browser: chromium-browser: arbitrary code execution via out-of-bounds write in ANGLE
Out of bounds write in ANGLE in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Bugzilla
CVE-2026-95335 chromium-browser: chromium-browser: arbitrary code execution via use-after-free in HID
bugzilla·2026-09-29·CVSS 8.3
CVE-2026-95335 [HIGH] CVE-2026-95335 chromium-browser: chromium-browser: arbitrary code execution via use-after-free in HID
CVE-2026-95335 chromium-browser: chromium-browser: arbitrary code execution via use-after-free in HID
Use after free in HID in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Bugzilla
CVE-2026-102329 chromium-browser: chromium-browser: Cross-site scripting in WebUI
bugzilla·2026-09-29·CVSS 6.1
CVE-2026-102329 [MEDIUM] CVE-2026-102329 chromium-browser: chromium-browser: Cross-site scripting in WebUI
CVE-2026-102329 chromium-browser: chromium-browser: Cross-site scripting in WebUI
Cross-site scripting in WebUI in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to bypass web origin policy into a privileged page via a crafted HTML page. (Chromium security severity: High)
Bugzilla
CVE-2026-95365 chromium-browser: chromium-browser: Arbitrary code execution in IndexedDB via crafted HTML page
bugzilla·2026-09-29·CVSS 8.8
CVE-2026-95365 [HIGH] CVE-2026-95365 chromium-browser: chromium-browser: Arbitrary code execution in IndexedDB via crafted HTML page
CVE-2026-95365 chromium-browser: chromium-browser: Arbitrary code execution in IndexedDB via crafted HTML page
Type confusion in IndexedDB in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Bugzilla
CVE-2026-95302 chromium-browser: chromium-browser: Information disclosure via improper authorization in WebAPKs
bugzilla·2026-09-29·CVSS 2.9
CVE-2026-95302 [LOW] CVE-2026-95302 chromium-browser: chromium-browser: Information disclosure via improper authorization in WebAPKs
CVE-2026-95302 chromium-browser: chromium-browser: Information disclosure via improper authorization in WebAPKs
Incorrect authorization in WebAPKs in Google Chrome on on Android prior to 154.0.8037.57 allowed a local attacker to obtain cross-origin data via a co-installed app. (Chromium security severity: Medium)
Bugzilla
CVE-2026-95282 chromium-browser: chromium-browser: Use after free in Platform
bugzilla·2026-09-29·CVSS 8.8
CVE-2026-95282 [HIGH] CVE-2026-95282 chromium-browser: chromium-browser: Use after free in Platform
CVE-2026-95282 chromium-browser: chromium-browser: Use after free in Platform
Use after free in Platform in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Bugzilla
CVE-2026-102314 chromium-browser: chromium-browser: UI spoofing via crafted HTML page
bugzilla·2026-09-29·CVSS 5.4
CVE-2026-102314 [MEDIUM] CVE-2026-102314 chromium-browser: chromium-browser: UI spoofing via crafted HTML page
CVE-2026-102314 chromium-browser: chromium-browser: UI spoofing via crafted HTML page
UI misrepresentation in TabStrip in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)
Bugzilla
CVE-2026-95330 chromium-browser: Improper state validation in Downloads
bugzilla·2026-09-29·CVSS 6.5
CVE-2026-95330 [MEDIUM] CVE-2026-95330 chromium-browser: Improper state validation in Downloads
CVE-2026-95330 chromium-browser: Improper state validation in Downloads
Improper state validation in Downloads in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
https://community.progress.com/s/article/LoadMaster-Critical-Security-Bulletin-June-2026-CVE-2026-8037-CVE-2026-33691https://labs.watchtowr.com/enterprise-tech-in-shell-out-progress-kemp-loadmaster-uninitialized-heap-to-pre-auth-rce-cve-2026-8037/https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-8037https://www.esentire.com/security-advisories/progress-kemp-loadmaster-vulnerability-targeted-cve-2026-8037
2026-06-04
Published
2026-08-07
Added to CISA KEV
Exploited in the wild