CVE-2026-122518

MediumCVSS 6.5/10Last modified Nov 11, 2026

Description

Out-of-bounds read in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-125

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Nov 10, 2026
Last modified
Nov 11, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-122527.8In nltk/nltk versions 3.9.3 and earlier, five Stanford interface classes (StanfordPOSTagger, StanfordNERTagger, StanfordParser, StanfordDepeCVE-2026-122546.4Netskope is notified about a potential gap in its agent (NSClient) where a system with Netskope Client while connecting to an access point wCVE-2026-122558.1The MainWP Child WordPress plugin before 6.1.2 does not verify the requester's identity in its site-registration request handler when passwCVE-2026-122568.8Deserialization of Untrusted Data vulnerability in ThemeFusion Fusion Builder fusion-builder allows Object Injection.This issue affects FusiCVE-2026-122579.3Versions of Mura CMS prior to 10.0.712 contain a critical remote code execution (RCE) vulnerability. The flaw is located in the endpoint “/iCVE-2026-122589.2Inadequate access control in Hiperdino’s REST v1.0 API. The public endpoint ‘customer/check’ could allow an authenticated attacker to enter CVE-2026-122596.5In nltk version 3.9.4, the `nltk.downloader.Downloader._download_package()` function writes downloaded package bytes to disk and may extractCVE-2026-12267.0CWE‑94: Improper Control of Generation of Code vulnerability exists that could cause execution of untrusted or unintended code within the apCVE-2026-1226010.0SQL injection in the NetBoard CRM demo platform; specifically, the vulnerable component is the ‘user-name’ POST parameter in the ‘/module/auCVE-2026-122616.5A vulnerability in `nltk.downloader` in nltk/nltk versions <= 3.9.4 allows for cross-package resource and model poisoning. The downloader exCVE-2026-122638.8Zohocorp ManageEngine Password Manager Pro versions before 13232 and PAM360 versions before 8551 are vulnerable to an authentication bypass CVE-2026-122648.8Zoho Corporation ManageEngine DDI Central versions 6200 and below are vulnerable to arbitrary file write via HA Failover Config sync upload
CVE-2026-122518: Medium severity, CVSS 6.5 | Vulnix