CVE-2026-8874

HighCVSS 7.1/10Last modified Jul 22, 2026

Description

Version 3.0.7 of the Securly Chrome Extension downloads JSON files containing crisis alert keywords and filtering rules over unencrypted HTTP via the Fetch API. Other endpoints in the same extension correctly fetch IWF and CIPA data over HTTPS, demonstrating an inconsistent implementation of TLS.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

Weakness enumeration

CWE-319

Affected software

No affected versions have been published.

Timeline

Published: Jun 3, 2026
Last modified: Jul 22, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-887425.4Bacularis 1.0.0 - 6.5.0 is vulnerable to Stored cross-site scripting (XSS) in the client address field.CVE-2026-887436.1Bacularis 4.7.0 - 6.5.0 is vulnerable to Stored cross-site scripting (XSS) in director tags.CVE-2026-887456.1EMLOG-Pro 2.6.29 contains a XSS vulnerability that enables attackers to upload a malicious shell.CVE-2026-887467.1idccms V1.70 is vulnerable to Cross Site Scripting (XSS) in /admin/makeDiy_deal.php.CVE-2026-88756.4The Easy Prism Syntax Highlighter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'code' (and 'c') shortc CVE-2026-887537.5A Regular-Expression Denial of Service (ReDoS) in the Markdown2. extract_metadata() function (lib/markdown2.py) of trentm markdown2 through CVE-2026-887557.8Z.ai ZCode v3.11.2.6792 was discovered to automatically establish connections with MCP servers declared inside a repository's workspace conf CVE-2026-887565.3Pagekit CMS <= 1.0.18 allows an unauthenticated attacker to perform SQL injection through the credentials array submitted to the public logi CVE-2026-88767.3Version 3.0.7 of the Securly Chrome Extension contains hardcoded, plaintext AES passphrases in securly.min.js. These keys decrypt crisis ale CVE-2026-887615.3The Botslab G980H dash camera firmware generates the default WiFi password using predictable device information, portions of which are adver CVE-2026-887635.9A flaw was found in the skupper-router component of Red Hat Service Interconnect, which is used to provide secure communication between dist CVE-2026-887645.4The Simple Membership WordPress plugin before 4.7.8 does not validate that the membership level supplied in a PayPal payment notification ma