CVE-2026-79078

Use after free in FedCM in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-79027

Use after free in WebRTC in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via crafted network traffic. Chromium security severity: High...

CVE-2026-79149

A Use after free vulnerability in the ANGLE component of Google Chrome (prior to version 152.0.7977.65) allows a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. The vulnerability is associated with high security severity and carries a CRITICAL CVSS 3.1 base ...

CVE-2026-79188

Out of bounds write in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-79111

Improper input validation in Dawn in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-79187

Use after free in WebRTC in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-79183

A Use after free vulnerability in the Accessibility component of Google Chrome (and other Chromium-based browsers like Microsoft Edge ) allows a remote attacker to execute arbitrary code outside the sandbox. The attack requires social engineering and UI Interaction . This issue affects versions p...

CVE-2026-79202

A use after free vulnerability exists in Chromecast within Google Chrome (prior to version 152.0.7977.65 ). This flaw allows a remote attacker to execute arbitrary code inside the sandbox by hosting a crafted HTML page . The vulnerability has been addressed in various distributions, including Fed...

CVE-2026-79292

Integer overflow in Chromecast in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-79218

Incorrect authorization in Sandbox in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-79121

The Chromium web browser and Google Chrome (prior to version 152.0.7977.65) are vulnerable to a critical security flaw caused by improper input validation in Chromecast . A remote attacker who has already compromised the renderer process can exploit this by serving a crafted HTML page to execute ...

CVE-2026-79121

Improper input validation in Chromecast in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Critical...

EUVD-2026-65967

Use after free in Chromecast in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Critical...

USN-8679-1 vim vulnerability

It was discovered that Vim incorrectly handled certain tags files. An attacker could possibly use this issue to execute arbitrary code...

CVE-2026-78379 Consent bypass in python_repl tool via batch kwargs forwarding in Amazon Strands Agents Tools

Improper neutralization of input used for LLM prompting in the pythonrepl tool in Amazon Strands Agents Tools before 0.8.5 might allow remote actors to execute arbitrary Python code on the agent's host by bypassing the human consent gate, via a crafted prompt that forwards noninteractivemode as a...

CVE-2026-78379 Consent bypass in python_repl tool via batch kwargs forwarding in Amazon Strands Agents Tools

Improper neutralization of input used for LLM prompting in the pythonrepl tool in Amazon Strands Agents Tools before 0.8.5 might allow remote actors to execute arbitrary Python code on the agent's host by bypassing the human consent gate, via a crafted prompt that forwards noninteractivemode as a...

EUVD-2026-65735

Improper neutralization of input used for LLM prompting in the pythonrepl tool in Amazon Strands Agents Tools before 0.8.5 might allow remote actors to execute arbitrary Python code on the agent's host by bypassing the human consent gate, via a crafted prompt that forwards noninteractivemode as a...

GHSA-3H2G-J4WP-7QQQ Duplicate Advisory: JVM argument injection bypass via per-call options in the NLTK Stanford wrappers (incomplete fix of CVE-2026-12841)

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-m4rf-3fr8-xwx3. This link is maintained to preserve external references. Original Description NLTK before 3.10.3 fails to validate JVM options passed through the per-call options parameter in the java function,...

Duplicate Advisory: JVM argument injection bypass via per-call options in the NLTK Stanford wrappers (incomplete fix of CVE-2026-12841)

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-m4rf-3fr8-xwx3. This link is maintained to preserve external references. Original Description NLTK before 3.10.3 fails to validate JVM options passed through the per-call options parameter in the java function,...

AZL-98195 CVE-2026-79992 affecting package emacs for versions less than 29.4-6

A flaw was found in Emacs TRAMP. A local attacker could exploit this vulnerability by processing maliciously crafted filenames. This occurs because TRAMP concatenates login arguments without proper sanitization, which are then passed to a local shell. Successful exploitation could lead to arbitra...