CVE-2026-120733: Devolutions Server: Cleartext storage of sensitive information in the user account data in Devolutions Server 2026.3.12.0 and earlier…

Cleartext storage of sensitive information in the user account data in Devolutions Server 2026.3.12.0 and earlier allows an attacker with read access to the database or a database backup to obtain users' TOTP shared secrets via the unencrypted copy of the security key written when an administrato...

AlmaLinux 9.2 [TuxCare] Security Update: log4j / log4j-jcl / log4j-slf4j / log4j-web (ALMALINUX9.2:CLSA-2026:1792633697)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1792633697 advisory. - The fix for CVE-2025-68161 https://logging.apache.org/security.htmlCVE-2025-68161 was incomplete: it addressed hostname verification only...

RockyLinux 9 : opentelemetry-collector (RLSA-2026:93617)

The remote RockyLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RLSA-2026:93617 advisory. net/http: golang: golang: Denial of Service via crafted HTTP Range headers CVE-2026-78667 crypto/tls: golang: crypto/tls: Denial of Service via multiple...

Linux Distros Unpatched Vulnerability : CVE-2026-74846

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the legacy password verifier...

CVE-2026-95736: Hewlett Packard Enterprise (HPE) Fabric Composer: Improper certificate validation vulnerabilities exist in the affected interface of HPE Networking Fabric Composer,…

Improper certificate validation vulnerabilities exist in the affected interface of HPE Networking Fabric Composer, which could be exploited by an unauthenticated adjacent attacker if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker t...

CVE-2026-121728: SourceHut meta.sr.ht: SourceHut meta.sr.ht 0.56.11 before 0.89.0 contains an authorization bypass vulnerability that allows unauthenticated…

SourceHut meta.sr.ht 0.56.11 before 0.89.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to register accounts when public registration is disabled. Attackers can obtain a CSRF token from /login and POST credentials to /register/step2, which invokes the...

CVE-2026-121116: Google Chrome: Missing authorization in WebView in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker who…

Missing authorization in WebView in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-121059: Google Chrome: Information leak in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to leak cross-origin data…

Information leak in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-121062: Google Chrome: Incorrect authorization in API in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised…

Incorrect authorization in API in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-121064: Google Chrome: Improper input validation in Performance in Google Chrome prior to 157.0.8103.38 allowed a local attacker to…

Improper input validation in Performance in Google Chrome prior to 157.0.8103.38 allowed a local attacker to potentially execute arbitrary code inside the sandbox via a local program. Chromium security severity: Low...

CVE-2026-121077: Google Chrome: Use after free in Mobile in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social…

Use after free in Mobile in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-121079: Google Chrome: Race condition in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside…

Race condition in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-121080: Google Chrome: Use after free in Codecs in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory inside the…

Use after free in Codecs in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-121162: Google Chrome: UI misrepresentation in Notifications in Google Chrome on on Windows prior to 157.0.8103.38 allowed a remote attacker…

UI misrepresentation in Notifications in Google Chrome on on Windows prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. Chromium security severity: Low...

CVE-2026-121164: Google Chrome: Incorrect authorization in Views in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker leveraging…

Incorrect authorization in Views in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-121219: Google Chrome: Integer overflow in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the…

Integer overflow in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-121232: Google Chrome: Incorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a local attacker leveraging social…

Incorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a local attacker leveraging social engineering to obtain sensitive information via a co-installed app. Chromium security severity: Low...

CVE-2026-121233: Google Chrome: Type confusion in CacheStorage in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary…

Type confusion in CacheStorage in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-95757: Hewlett Packard Enterprise (HPE) Fabric Composer: A local authentication bypass vulnerability exists in an API of HPE Networking Fabric Composer

A local authentication bypass vulnerability exists in an API of HPE Networking Fabric Composer. Successful exploitation could allow a local attacker with low privileges to write arbitrary files to remote servers configured on the affected system...

CVE-2026-104608: GitHub Enterprise Server: A remote code execution vulnerability was identified in GitHub Enterprise Server in the Git service (babeld)

A remote code execution vulnerability was identified in GitHub Enterprise Server in the Git service babeld. babeld held references into internal collections while calling into the SSH library, where a re-entrant callback could modify a collection and invalidate those references. An attacker with ...