CVE-2026-17709

Race in Downloads in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: High...

CVE-2026-17709

A race condition in the Downloads component of Google Chrome on Mac (prior to version 151.0.7922.72 ) allows a remote attacker who has already compromised the renderer process to potentially perform a sandbox escape . This can be achieved by navigating to a crafted HTML page. The vulnerability ha...

CVE-2026-17711: Concurrent Execution using Shared Resource with Improper Synchronization

Race in Downloads in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: High...

CVE-2026-17709: Concurrent Execution using Shared Resource with Improper Synchronization

Race in Downloads in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: High...

PT-2026-66028

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 151.0.7922.72 Description A race condition in the downloads component on Mac allows a remote attacker who has already compromised the renderer process to potentially perform a sandbox escape. This is achieved by...

PT-2026-66030

Name of the Vulnerable Software and Affected Versions Google Chrome on Mac versions prior to 151.0.7922.72 Description A race condition in the downloads component allows a remote attacker who has already compromised the renderer process to potentially perform a sandbox escape. This is achieved by...

Linux Distros Unpatched Vulnerability : CVE-2026-17709

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Race in Downloads in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a...

CVE-2026-13346 pip absolute path traversal during download from malicious package indexes

pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels. This vulnerability requires downloading or installing a package from a malicious package index to succeed, malicious packages alone...

CVE-2026-12476

The Easy Digital Downloads plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to and including 3.6.9. This is due to insufficient file type validation in the edddoajaximportfileupload function , which only checks the client-supplied $FILES'edd-import-file''type' Content-Ty...

CVE-2026-12476

The Easy Digital Downloads plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to and including 3.6.9. This is due to insufficient file type validation in the edddoajaximportfileupload function , which only checks the client-supplied $FILES'edd-import-file''type' Content-Ty...

CVE-2026-12476 Easy Digital Downloads <= 3.6.9 - Authenticated (Shop Manager+) Arbitrary File Upload via 'edd-import-file' Parameter

The Easy Digital Downloads plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to and including 3.6.9. This is due to insufficient file type validation in the edddoajaximportfileupload function , which only checks the client-supplied $FILES'edd-import-file''type' Content-Ty...

EUVD-2026-50108

The Easy Digital Downloads plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to and including 3.6.9. This is due to insufficient file type validation in the edddoajaximportfileupload function , which only checks the client-supplied $FILES'edd-import-file''type' Content-Ty...

CVE-2026-12476 Easy Digital Downloads <= 3.6.9 - Authenticated (Shop Manager+) Arbitrary File Upload via 'edd-import-file' Parameter

The Easy Digital Downloads plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to and including 3.6.9. This is due to insufficient file type validation in the edddoajaximportfileupload function , which only checks the client-supplied $FILES'edd-import-file''type' Content-Ty...

CVE-2026-12476

The Easy Digital Downloads plugin for WordPress (up to v3.6.9) is affected by Arbitrary File Upload due to insufficient validation in edd_do_ajax_import_file_upload(). The function relies on the client-provided $_FILES['edd-import-file']['type'] against a CSV allow-list and uses raw move_uploaded...

CVE-2026-12476: Unrestricted Upload of File with Dangerous Type

The Easy Digital Downloads plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to and including 3.6.9. This is due to insufficient file type validation in the edddoajaximportfileupload function , which only checks the client-supplied $FILES'edd-import-file''type' Content-Ty...

PT-2026-65685

The Easy Digital Downloads plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to and including 3.6.9. This is due to insufficient file type validation in the edd do ajax import file upload function , which only checks the client-supplied $ FILES'edd-import-file''type'...

📄 Let's Chat 0.4.8 Information Disclosure

Let's Chat versions 0.4.8 and earlier contain an information disclosure vulnerability in the file download functionality. Any authenticated user can download attachments from private and password-protected rooms without authorization if they know or can derive the associated file identifier...

CVE-2026-54719

goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.1, the httpserver/updown.go bulkDownload handler for ?bulk&file= ZIP downloads did not call findEffectiveACL or applyCustomAuth, allowing unauthenticated reads of files protected only by .goshs folder...

Malicious code in lib-streak-math (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06cd4f53bed50a86ce85bcd8ebcd672ae7e3c01926cac1efd7f3dcf152484267 The package's main entry index.mjs presents itself as a math helper but contains a top-level async IIFE that runs on any require/import of the module...

MAL-2026-11141 Malicious code in lib-streak-math (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06cd4f53bed50a86ce85bcd8ebcd672ae7e3c01926cac1efd7f3dcf152484267 The package's main entry index.mjs presents itself as a math helper but contains a top-level async IIFE that runs on any require/import of the module...