Litestar has HTML Injection Through its CSRF Token

Overview Litestar instances which use a template engine in conjunction with CSRF protection are vulnerable to HTML Injection which can be escalated to Cross Site Scripting due to the contents of the CSRF cookie being excluded from automatic escaping by the template engine when configured inline...

CVE-2026-11649

An use after free flaw was found in the V8 component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=511270083...

Exploit for Out-of-bounds Read in Google Chrome

CVE-2026-11645 - Chrome V8 Out-of-Bounds Read/Write Exploit...

SUSE CVE-2026-11645

Out of bounds read and write in V8 in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...

SUSE CVE-2026-11649

Use after free in V8 in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...

SUSE CVE-2026-11650

Use after free in V8 in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...

com.alibaba.smart.framework:smart-engine-extension-storage-mongodb (>=2.0.4, <=2.6.4), org.springframework.boot:spring-boot-starter-data-mongodb (1.4.7.release) +3 more potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (1.9.11.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.9.11.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: -...

com.alibaba.smart.framework:smart-engine-extension-storage-mongodb (>=2.0.4, <=2.6.4), org.springframework.boot:spring-boot-starter-data-mongodb (1.4.7.release) +3 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (1.9.11.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.9.11.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: -...

Google Chrome V8 Engine Code Execution

The vulnerability of the JavaScript script handler in Google Chrome’s V8 engine is related to the execution of operations outside of the buffer in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code through a specially created HTML page...

ROS-20260610-73-0021

The vulnerability of the JavaScript Engine component in Mozilla Firefox, Firefox ESR, and the email client Thunderbird is related to access to resources through incompatible types. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility ...

CVE-2026-48096: Insufficient Verification of Data Authenticity

OpenFGA is an authorization/permission engine built for developers. Prior to version 1.16.0, when iterator caching is enabled, two distinct check requests can produce the same cache key, leading to OpenFGA reusing an earlier cached result for a subsequent request. This issue has been patched in...

CVE-2026-0270: Improper Limitation of a Pathname to a Restricted Directory

A path traversal vulnerability in Palo Alto Networks Cortex XSOAR engine software running on Linux allows an unauthenticated attacker on an adjacent network, with the ability to intercept and manipulate network response traffic via a man-in-the-middle MITM attack, to write arbitrary files to the...

PT-2026-48542

Name of the Vulnerable Software and Affected Versions Litestar version 2.21.0 Description Instances using a template engine such as Jinja, Mako, or MiniJinja in conjunction with CSRF protection are susceptible to HTML Injection. This occurs when the application is configured to include CSRF input...

EulerOS 2.0 SP13 : docker-engine (EulerOS-SA-2026-2327)

According to the versions of the docker-engine package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows attackers to...

PT-2026-54697

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 150.0.7871.46 Description An integer overflow in the V8 engine allows a remote attacker to execute arbitrary code within a sandbox by inducing a user to open a specially crafted HTML page. V8 is the open-source...

EulerOS 2.0 SP13 : docker-engine (EulerOS-SA-2026-2284)

According to the versions of the docker-engine package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows attackers to...

PT-2026-66036

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 151.0.7922.72 Description An integer overflow in ANGLE, a graphics abstraction layer, allows a remote attacker to potentially perform a sandbox escape by inducing the browser to process a crafted HTML page...

data-designer (>=0.2.2, <=0.6.0), data-designer-engine (>=0.4.0rc1, <=0.6.0) +4 more potentially affected by CVE-2026-46373 via sqlfluff (3.4.0)

sqlfluff PYPI version 3.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - data-designer =0.2.2, =0.4.0rc1, =0.4.27, =0.1.0, =0.2.0 - sqlfluff-templater-dataform 0.1.6 - sqlfluff-templater-dbt 3.4.0 Source cves:...

data-designer (>=0.2.2, <=0.6.0), data-designer-engine (>=0.4.0rc1, <=0.6.0) +4 more potentially affected by CVE-2026-46374 via sqlfluff (3.4.0)

sqlfluff PYPI version 3.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - data-designer =0.2.2, =0.4.0rc1, =0.4.27, =0.1.0, =0.2.0 - sqlfluff-templater-dataform 0.1.6 - sqlfluff-templater-dbt 3.4.0 Source cves:...

minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions

A flaw was found in minimatch. A remote attacker could exploit this vulnerability by providing a specially crafted glob expression with nested unbounded quantifiers. This could lead to catastrophic backtracking in the V8 JavaScript engine, causing the application to become unresponsive and...