EUVD-2026-69748

Incorrect authorization in TabStrip in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Medium...

EUVD-2026-69734

Use after free in Browser in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

RHEL 7 : freerdp (RHSA-2026:62401)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:62401 advisory. FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. The xfreerdp client can connect to...

CVE-2023-20577: Stack-based Buffer Overflow

A heap overflow in SMM module may allow an attacker with access to a second vulnerability that enables writing to SPI flash, potentially resulting in arbitrary code execution...

CVE-2026-53671: Incorrect Calculation

PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer. Prior to version 0.2.4, the abstract transformer in prevail treats writes through a TCTX-typed base register as a silent no-op: domemstore in src/crab/ebpftransformer.cpp only models TSTACK stores, and the...

CVE-2026-84670: Deserialization of Untrusted Data

Jenkins Performance Plugin 1015.v09ca52b3370e and earlier does not restrict the classes that can be instantiated when deserializing cached performance reports stored in the build directory on the Jenkins controller, allowing attackers with Item/Configure permission to execute arbitrary code on th...

CVE-2026-84354: Incorrect Authorization

Incorrect authorization in FileSystem in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-84350: Use After Free

Use after free in TabStrip in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via UI Interaction. Chromium security severity: Low...

CVE-2026-84349: Use After Free

Use after free in Browser in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-84347: Use After Free

Use after free in WebRTC in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-84324: Use After Free

Use after free in Proxy in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network traffic. Chromium security severity: High...

PT-2026-114463

Уязвимость компонента ndsudo программного инструмента мониторинга Netdata связана с недостатками механизма десериализации. Эксплуатация уязвимости может позволить нарушителю выполнить произвольный код...

CVE-2026-84334: Incorrect Authorization

Incorrect authorization in Chromoting in Google Chrome on on Windows prior to 152.0.7977.75 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. Chromium security severity: Medium...

Important: freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fixes: FreeRDP: FreeRDP: Memory disclosure or denial of service via crafted RDP...

CVE-2026-84452: Permissive Cross-domain Policy with Untrusted Domains

Windows ML CLI is a command line tool for building portable, performant, and high-quality AI models for Windows ML. Prior to 0.4.0, the src/winml/modelkit/serve/cliapi.py component exposes WinML CLI commands through a localhost HTTP API without authentication and configures the alloworigins setti...

PT-2026-84865

Name of the Vulnerable Software and Affected Versions Windows ML CLI versions prior to 0.4.0 Description The src/winml/modelkit/serve/cli api.py component exposes commands through a localhost HTTP API without authentication and uses a wildcard for the allow origins setting. This allows a maliciou...

Extensions vulnerability Google Chrome Microsoft Edge Code Execution sandbox

The Extension component vulnerability in Google Chrome and Microsoft Edge web browsers is related to the ability to use memory after it has been freed. Exploitation of this vulnerability enables a remote attacker to execute arbitrary code within a sandbox via a specially crafted extension in Chro...

elFinder Volume Driver Code Execution

The vulnerability of the checkExtractItems method in the elFinderVolumeDriver.class.php file of the elFinder file manager allows for unlimited downloading of malicious files. Exploiting this vulnerability could enable a remote attacker to execute arbitrary code...

TOTOLINK A7000R Router Code Execution

The vulnerability of the setUploadUserData function in the /cgi-bin/cstecgi.cgi file of the TOTOLINK A7000R router’s microprogramming system exists due to the lack of measures to neutralize special elements. Exploiting this vulnerability can allow a remote attacker to execute arbitrary code...

Workers mechanism Code Execution

The vulnerability in Google Chrome and Microsoft Edge’s Workers mechanism is related to insufficient input validation. Exploitation of this vulnerability could allow a remote attacker to execute arbitrary code...