CVE-2026-121249: Google Chrome: Buffer overflow in ANGLE in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code…

Buffer overflow in ANGLE in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-116666: Tanium Discover: Tanium addressed an information disclosure vulnerability in Discover.

Tanium addressed an information disclosure vulnerability in Discover...

CVE-2026-113733: djangoproject Django: An issue was discovered in Django 6.1 before 6.1.3 and 6.0 before 6.0.10

An issue was discovered in Django 6.1 before 6.1.3 and 6.0 before 6.0.10. The django.contrib.admin.utils.displayforfield function did not obfuscate the password field of user models other than AUTHUSERMODEL, or of an AUTHUSERMODEL inheriting its password field from a concrete parent model through...

CVE-2026-121245: Google Chrome: Race condition in Autofill in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially obtain…

Race condition in Autofill in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially obtain sensitive information via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-118237: GitHub Enterprise Server: An out-of-bounds read vulnerability was identified in GitHub Enterprise Server in the Git service (babeld)

An out-of-bounds read vulnerability was identified in GitHub Enterprise Server in the Git service babeld. When proving possession of a host key, babeld's SSH implementation sized the session identifier by the current digest length rather than its own. An attacker with an account and SSH access...

CVE-2026-65109: NVIDIA Slurm: NVIDIA Slurm is subject to a symlink resolution issue in the container cleanup code that could allow an attacker to…

NVIDIA Slurm is subject to a symlink resolution issue in the container cleanup code that could allow an attacker to remove files outside of their control on the compute node...

CVE-2026-120757: The HDF Group HDF5: HDF5 through 2.2.0 contains a heap buffer over-read vulnerability in H5L__extern_traverse() in src/H5Lexternal.c, the…

HDF5 through 2.2.0 contains a heap buffer over-read vulnerability in H5Lexterntraverse in src/H5Lexternal.c, the default traversal callback for external links. The callback locates the target file name and object path within the link’s user data using strlen without validating the buffer against...

CVE-2026-120538: smub Easy Digital Downloads – eCommerce Payments and Subscriptions made easy: The Easy Digital Downloads plugin for WordPress is vulnerable to authentication bypass leading to administrator account…

The Easy Digital Downloads plugin for WordPress is vulnerable to authentication bypass leading to administrator account takeover in all versions up to, and including, 3.7.2. During a PayPal guest checkout, the email address entered in the guest-checkout field is trusted as proof of identity:...

CVE-2026-54161: networkupstools nut: Network UPS Tools is a collection of programs which provide a common interface for monitoring and administering UPS,…

Network UPS Tools is a collection of programs which provide a common interface for monitoring and administering UPS, PDU and SCD hardware. From 2.8.3 to 2.8.5, upsmon in clients/upsmon.c inserts the server-supplied ups.alarm value into shell commands executed by notify, asyncnotify, and wall. Whe...

CVE-2026-63395: isomorphic-git: isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers

isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git's git.checkout writes new child paths through symlinked leading directory components without checking them. A malicious repository can first place a directory symlink and later...

CVE-2026-63489: yeti-platform yeti: Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline

Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline. In version 2.5.0 and earlier, YETI directly interpolates user-controlled sorting fields and filteraliases attribute paths into ArangoDB AQL identifier and expression positions in...

CVE-2026-95738: Hewlett Packard Enterprise (HPE) Fabric Composer: Authentication bypass vulnerabilities in the affected interface of HPE Networking Fabric Composer could allow an…

Authentication bypass vulnerabilities in the affected interface of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to circumvent existing authentication controls if certain preconditions outside of the attacker's control are met. Successful exploitation could allow a...

CVE-2026-95748: Hewlett Packard Enterprise (HPE) Fabric Composer: A SQL injection vulnerability exists in HPE Networking Fabric Composer

A SQL injection vulnerability exists in HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated adjacent attacker to run arbitrary database commands...

CVE-2026-95769: Hewlett Packard Enterprise (HPE) Fabric Composer: An audit log spoofing vulnerability exists in the API of HPE Networking Fabric Composer

An audit log spoofing vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated remote attacker to falsify the client address recorded in audit records...

CVE-2026-111211: djangoproject Django: An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19

An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. django.contrib.gis.forms.widgets.BaseGeometryWidget.deserialize, used by django.contrib.gis.forms.GeometryField, does not escape invalid submitted values before logging them, which allows remote attacker...

CVE-2026-114582: djangoproject Django: An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19

An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. django.contrib.gis.gdal.SpatialReference and related transform methods and srs/srid setters do not restrict GDAL’s file and network access when parsing string input, which allows attackers to trigger...

CVE-2026-121603: solanum-ircd solanum: Solanum before commit 2ea1382 contains a buffer overflow vulnerability in ms_kill() that allows malicious linked…

Solanum before commit 2ea1382 contains a buffer overflow vulnerability in mskill that allows malicious linked servers to corrupt memory by sending an overlong kill reason. Attackers controlling a rogue or compromised peer server can send a reason exceeding KILLLEN that overflows a static 512-byte...

CVE-2026-120987: NAVER NAVER Whale browser: Whale Browser before 5.39.412.57 allows an attacker to bypass the iframe sandbox in a dual-tab environment.

Whale Browser before 5.39.412.57 allows an attacker to bypass the iframe sandbox in a dual-tab environment...

CVE-2026-120734: Devolutions Server: Cleartext transmission of sensitive information in the email configuration test in Devolutions Server 2026.3.13.0 and…

Cleartext transmission of sensitive information in the email configuration test in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with access to the test action to obtain the stored SMTP password via a request that names an attacker-controlled SMTP host...

CVE-2026-120716: Devolutions Server: Insertion of sensitive information into sent data in the identity provider user synchronization in Devolutions Server…

Insertion of sensitive information into sent data in the identity provider user synchronization in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with the delegated permission to update users from the identity provider to obtain other users' MFA secrets via the...