CVE-2026-95373

Use after free in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-95277

Use after free in Views in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-95283

Buffer overflow in Tint in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-95355

Incorrect authorization in Navigation in Google Chrome on on iOS prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-95298

Use after free in Browser in Google Chrome prior to 154.0.8037.57 allowed a local attacker to potentially execute arbitrary code outside the sandbox via UI Interaction. Chromium security severity: High...

CVE-2026-95310

Use after free in AdFilter in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Critical...

CVE-2026-95329

Out of bounds write in WebGL in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Critical...

CVE-2026-95349

Buffer overflow in WebGL in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Critical...

CVE-2026-95322

Out of bounds write in GPU in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Critical...

CVE-2026-95281

Buffer overflow in ANGLE in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Critical...

CVE-2026-95339

A use after free vulnerability exists in the ServiceWorker component of Google Chrome prior to version 154.0.8037.57 . This flaw allows a remote attacker to execute arbitrary code outside the sandbox by leveraging a crafted HTML page. The impact is categorized as Critical by Chromium security. Re...

CVE-2026-95350

Buffer overflow in ANGLE in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Critical...

OPENSUSE-SU-2026:21974-1 Security update for emacs

This update for emacs fixes the following issue: - CVE-2026-96442: arbitrary code execution when viewing or editing untrusted text files in modes other than Emacs Lisp mode bsc1282390...

CVE-2026-92368

TeamViewer Full Client and Host for Linux and macOS prior version 15.82 contain a heap-based buffer overflow vulnerability in the processing of .tvs session recording files. A size mismatch during decompression of recorded session data can result in out-of-bounds heap writes. By convincing a user...

CVE-2026-78683

A flaw was found in NLTK. This vulnerability allows arbitrary code execution due to unsafe deserialization, where data loaded from storage is converted back into active objects without adequate restrictions. When the TransitionParser component processes a model file, it fails to enforce safe...

CVE-2026-102630

UnoPim versions before 2.0.1 and 2.1.1 trust all connecting clients as proxies and honor the X-Forwarded-Host header without validation, allowing unauthenticated attackers to inject arbitrary origins into admin layout pages. Attackers can set X-Forwarded-Host to redirect JavaScript asset loading ...

EUVD-2026-89021

TeamViewer Full Client and Host for Linux and macOS prior version 15.82 contain a heap-based buffer overflow vulnerability in the processing of .tvs session recording files. A size mismatch during decompression of recorded session data can result in out-of-bounds heap writes. By convincing a user...

Malicious code in exptredd (npm)

Source: amazon-inspector 288357063a28e85e649fc37c747c724bd06ce09c16624f7b2cad3dc854296035 npm package [email protected] impersonates the express package: package.json copies express's description, author, repository, contributors, and dependency list verbatim while shipping under the name 'exptredd'...

Malicious code in exptred (npm)

Source: amazon-inspector d91842ab3e5c93f5689a985b63f8de5455910d88d6815ee35f2d35d27f8a4cf7 npm package [email protected] is a typosquat of express: package.json copies express's description 'Fast, unopinionated, minimalist web framework', author TJ Holowaychuk, repository expressjs/express, and homepa...

Malicious code in exprrdd (npm)

Source: amazon-inspector bc1c956097cd13e80298a796a5026ebd91ece7c2ad53d226d3729f0b0b0ee9f3 Package 'exprrdd' copies express's metadata name-lookalike, description, author, contributors, repository, keywords, dependencies as cover for a preinstall dropper. package.json line 98 declares a preinstall...