CVE-2026-84670: Deserialization of Untrusted Data

Jenkins Performance Plugin 1015.v09ca52b3370e and earlier does not restrict the classes that can be instantiated when deserializing cached performance reports stored in the build directory on the Jenkins controller, allowing attackers with Item/Configure permission to execute arbitrary code on th...

CVE-2026-84350: Use After Free

Use after free in TabStrip in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via UI Interaction. Chromium security severity: Low...

CVE-2026-84349: Use After Free

Use after free in Browser in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-84324: Use After Free

Use after free in Proxy in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network traffic. Chromium security severity: High...

Deserialization of untrusted data vulnerability in performance

performance uses Java serialization to cache performance reports in the build directory. performance 1015.v09ca52b3370e and earlier does not restrict the classes that can be instantiated when deserializing cached performance reports stored in the build directory on the Jenkins controller. This...

CVE-2026-84334: Incorrect Authorization

Incorrect authorization in Chromoting in Google Chrome on on Windows prior to 152.0.7977.75 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. Chromium security severity: Medium...

PT-2026-114463

Уязвимость компонента ndsudo программного инструмента мониторинга Netdata связана с недостатками механизма десериализации. Эксплуатация уязвимости может позволить нарушителю выполнить произвольный код...

CVE-2026-84354: Incorrect Authorization

Incorrect authorization in FileSystem in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

perl-DBI security update

1.641-2 - Fix stack overflow and buffer overflow in DBI.xs CVE-2026-9698 Resolves: RHEL-211160 - Fix heap overflow in SQL preparsing can lead to denial of service or arbitrary code execution CVE-2026-10879 Resolves: RHEL-227962 - Fix unsafe string eval in DBI::Profile CVE-2026-14380 Resolves:...

Important: freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fixes: FreeRDP: FreeRDP: Memory disclosure or denial of service via crafted RDP...

Important: perl-DBI security update

DBI is a database access Application Programming Interface API for the Perl Language. The DBI API Specification defines a set of functions, variables and conventions that provide a consistent database interface independent of the actual database being used. Security Fixes: perl-DBI: perl-DBI: Hea...

CVE-2026-84452: Permissive Cross-domain Policy with Untrusted Domains

Windows ML CLI is a command line tool for building portable, performant, and high-quality AI models for Windows ML. Prior to 0.4.0, the src/winml/modelkit/serve/cliapi.py component exposes WinML CLI commands through a localhost HTTP API without authentication and configures the alloworigins setti...

PT-2026-84865

Name of the Vulnerable Software and Affected Versions Windows ML CLI versions prior to 0.4.0 Description The src/winml/modelkit/serve/cli api.py component exposes commands through a localhost HTTP API without authentication and uses a wildcard for the allow origins setting. This allows a maliciou...

CVE-2026-84347: Use After Free

Use after free in WebRTC in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Medium...

Workers mechanism Code Execution

The vulnerability in Google Chrome and Microsoft Edge’s Workers mechanism is related to insufficient input validation. Exploitation of this vulnerability could allow a remote attacker to execute arbitrary code...

ANGLE Library Code Execution

The vulnerability of the ANGLE library in Google Chrome and Microsoft Edge relates to writing beyond the buffer limit. Exploiting this vulnerability allows a malicious actor to execute arbitrary code within the sandbox by using a specially created HTML page...

Views Component Code Execution

The vulnerability of the Views component in Google Chrome and Microsoft Edge relates to the ability to utilize memory after it is freed. Exploiting this vulnerability could allow an attacker to execute arbitrary code through a specially created HTML page...

Extensions vulnerability Google Chrome Microsoft Edge Code Execution sandbox

The Extension component vulnerability in Google Chrome and Microsoft Edge web browsers is related to the ability to use memory after it has been freed. Exploitation of this vulnerability enables a remote attacker to execute arbitrary code within a sandbox via a specially crafted extension in Chro...

TOTOLINK A7000R Router Code Execution

The vulnerability of the setUploadUserData function in the /cgi-bin/cstecgi.cgi file of the TOTOLINK A7000R router’s microprogramming system exists due to the lack of measures to neutralize special elements. Exploiting this vulnerability can allow a remote attacker to execute arbitrary code...

SPIP analyse_resultat_skel() Code Execution

The vulnerability of the analyseresultatskel function in the SPIP content management system is related to improper handling of code generation. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...