EUVD-2026-74519

Incorrect authorization in Network in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. Chromium security severity: High...

CVE-2026-87578

A Use after free vulnerability exists in the Receiver component of the Chromium browser (and by extension, Google Chrome and Microsoft Edge ). This flaw allows an adjacent attacker to execute arbitrary code outside the sandbox by sending crafted network traffic . The issue affects versions of Goo...

EUVD-2026-74489

Incorrect authorization in Network in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. Chromium security severity: High...

CVE-2026-87578

Use after free in Receiver in Google Chrome prior to 153.0.8010.36 allowed an adjacent attacker to execute arbitrary code outside the sandbox via crafted network traffic. Chromium security severity: High...

CVE-2026-87578

Use after free in Receiver in Google Chrome prior to 153.0.8010.36 allowed an adjacent attacker to execute arbitrary code outside the sandbox via crafted network traffic. Chromium security severity: High...

CVE-2026-87628

A use after free vulnerability exists in the Cast component of the Chromium browser (and Google Chrome ) prior to version 153.0.8010.36 . This flaw allows an adjacent attacker to potentially execute arbitrary code outside the sandbox by sending crafted network traffic. The vulnerability is rated ...

CVE-2026-87628

Use after free in Cast in Google Chrome prior to 153.0.8010.36 allowed an adjacent attacker to potentially execute arbitrary code outside the sandbox via crafted network traffic. Chromium security severity: Critical...

CVE-2026-81640: Use of Hard-coded Credentials

An attacker could derive the camera's Wi-Fi password and connect to its wireless network. This weakens or eliminates the security value of the access-point password and may expose the live video stream, device services, status interfaces, and firmware-update functionality...

CVE-2026-86198: Improper Enforcement of a Single, Unique Action

PocketMine-MP versions before 5.44.2 fail to properly validate multiple ResourcePackClientResponsePacket packets with STATUSCOMPLETED status during resource pack handling. Malicious clients can send batches of these packets to repeatedly trigger pre-spawn progression, creating duplicate Player...

PT-2026-89076

An attacker could derive the camera's Wi-Fi password and connect to its wireless network. This weakens or eliminates the security value of the access-point password and may expose the live video stream, device services, status interfaces, and firmware-update functionality...

PT-2026-89187

A vulnerability has been found in Behavioral Technology Group Pavlok Behavioral Conditioning Wearable up to 20260707. Impacted is an unknown function of the component Apple Notification Center Service Event Handler. The manipulation leads to buffer overflow. The attack must be carried out from...

PT-2026-89075

The C6 ear camera transmits live video to the EarVision Android application over unencrypted UDP streams. The application manifest permits cleartext traffic, and captured network traffic contains reconstructable JPEG or WEBP video frames transmitted over UDP. An attacker within local wireless ran...

PT-2026-89104

Dell PowerScale OneFS, versions 9.5.0.0 through 9.7.1.15, versions 9.8.0.0 through 9.13.1.0, and versions prior to 9.15.0.0, contain an Incorrect Authorization vulnerability. A low privileged adjacent network attacker could potentially exploit this vulnerability, leading to unauthorized...

PT-2026-89131

A vulnerability in the web-based management interface of CPPM guest account management services could allow an unauthenticated remote attacker to manipulate account settings. Successful exploitation could allow an attacker to extend network access beyond policy limits, leading to unauthorized...

CVE-2026-73789: Improper Access Control

A vulnerability in the web-based management interface of CPPM guest account management services could allow an unauthenticated remote attacker to manipulate account settings. Successful exploitation could allow an attacker to extend network access beyond policy limits, leading to unauthorized...

CVE-2026-87578: Use After Free

Use after free in Receiver in Google Chrome prior to 153.0.8010.36 allowed an adjacent attacker to execute arbitrary code outside the sandbox via crafted network traffic. Chromium security severity: High...

PT-2026-89211

Unauthenticated Network-Exposed Turborepo Task Execution via /api/run Summary @yeger/turbo-graph starts its embedded Next.js server without binding to the loopback interface, causing it to listen on all network interfaces 0.0.0.0:29312 by default. The /api/run HTTP endpoint exposed by this server...

CVE-2026-87539: Observable Discrepancy

Observable discrepancy in Network in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromium security severity: Medium...

PT-2026-88634

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 153.0.8010.36 Description Missing authorization in the WebView component allows a remote attacker to bypass system access restrictions through the use of crafted network traffic and social engineering...

PT-2026-88622

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 153.0.8010.36 Description Missing authorization in the WebView component allows a remote attacker to potentially bypass system access restrictions through crafted network traffic, provided they can...