CVE-2026-121038: Google Chrome: Information leak in Compositing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain…

Information leak in Compositing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromium security severity: High...

CVE-2026-121065: Google Chrome: Incorrect authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social…

Incorrect authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-121114: Google Chrome: Use after free in TabStrip in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code…

Use after free in TabStrip in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-121157: Google Chrome: Incorrect authorization in Chromoting in Google Chrome prior to 157.0.8103.38 allowed a local attacker to bypass system…

Incorrect authorization in Chromoting in Google Chrome prior to 157.0.8103.38 allowed a local attacker to bypass system access restrictions via a local program. Chromium security severity: Low...

CVE-2026-121202: Google Chrome: Use after free in Autofill in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social…

Use after free in Autofill in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-121243: Google Chrome: Information leak in Frames in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive…

Information leak in Frames in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. Chromium security severity: Low...

CVE-2026-121388: FreeRDP: FreeRDP from 3.0.0 before 3.32.2 contains an uncontrolled resource allocation vulnerability that allows malicious RDP…

FreeRDP from 3.0.0 before 3.32.2 contains an uncontrolled resource allocation vulnerability that allows malicious RDP servers to force large client allocations through the DRDYNVC DATAFIRST Length field. Attackers can declare lengths up to 4,294,967,295 bytes on running dynamic channels, causing...

CVE-2026-76955: Zyxel NWA110AX firmware: A buffer overflow vulnerability in the zdp_wtp binary in Zyxel NWA110AX firmware versions through 7.12(ABTG.0)C0 could…

A buffer overflow vulnerability in the zdpwtp binary in Zyxel NWA110AX firmware versions through 7.12ABTG.0C0 could allow a LAN-based attacker to escalate privileges on an affected device...

CVE-2026-115779: Effect-TS, @effect: Effect is a TypeScript framework that consists of several packages that work together to help build TypeScript…

Effect is a TypeScript framework that consists of several packages that work together to help build TypeScript applications. From @effect/platform 0.1.0 until 0.97.1 and effect 4.0.0-beta.0 until 4.0.0-beta.103, the name, domain, and path fields passed to makeCookie allow semicolon delimiters tha...

CVE-2026-85035: zephyrproject zephyr: The can_add_rx_filter_msgq() system call installs a CAN RX filter whose callback (can_msgq_put() in…

The canaddrxfiltermsgq system call installs a CAN RX filter whose callback canmsgqput in drivers/can/cancommon.c is handed the caller's struct kmsgq as userdata. The controller driver stores that raw pointer in its filter table and dereferences it from the RX path every time a matching frame...

CVE-2026-95745: Hewlett Packard Enterprise (HPE) Fabric Composer: A vulnerability in the API of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to conduct…

A vulnerability in the API of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to conduct a denial of service attack. Successful exploitation could allow an attacker to cause the management services to become unavailable...

CVE-2026-95739: Hewlett Packard Enterprise (HPE) Fabric Composer: An improper restriction of excessive authentication attempts vulnerability in the API of HPE Networking Fabric Composer…

An improper restriction of excessive authentication attempts vulnerability in the API of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to conduct brute-force attacks against user accounts if certain preconditions outside of the attacker's control are met. Successfu...

CVE-2026-119487: weDevs Dokan: Missing Authorization vulnerability in weDevs Dokan dokan-lite allows Exploiting Incorrectly Configured Access Control…

Missing Authorization vulnerability in weDevs Dokan dokan-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dokan: from n/a through 5.3.2...

CVE-2026-121602: solanum-ircd solanum: Solanum before commit 2ce64de contains a heap-based buffer overflow vulnerability that allows a malicious linked server…

Solanum before commit 2ce64de contains a heap-based buffer overflow vulnerability that allows a malicious linked server to corrupt memory by sending overlong channel names in JOIN or SJOIN messages. Attackers controlling a peer server can trigger strcpy and sprintf overflows in msjoin and mssjoin...

CVE-2026-63476: isomorphic-git: isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers

isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git reads a server-controlled targetSize while applying a packfile delta in src/utils/applyDelta.js and passes it without a bound to Buffer.alloctargetSize. A malicious or...

CVE-2026-99261: Linux: In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: correct reservation fence slots for…

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: correct reservation fence slots for userq per-vm BOs eviction It fixes both the move overflow and the eviction fence add for evicting these per-vm BOs...

CVE-2026-16900: Zohocorp: Zohocorp ManageEngine Log360 and EventLog Analyzer versions 13071 and below are vulnerable to an authentication bypass…

Zohocorp ManageEngine Log360 and EventLog Analyzer versions 13071 and below are vulnerable to an authentication bypass in local collector registration, allowing unauthenticated actor to register a local collector by sending a specially crafted registration request...

CVE-2026-120559: satindersingh Contact Form Extender for Divi – Submissions DB & Extra Fields: The Contact Form Extender for Divi Builder plugin for WordPress is vulnerable to Arbitrary File Deletion due to…

The Contact Form Extender for Divi Builder plugin for WordPress is vulnerable to Arbitrary File Deletion due to insufficient file path validation in the cfefdremoveuploadedfile function in all versions up to, and including, 1.0.6. This makes it possible for unauthenticated attackers to delete...

CVE-2026-120327: TYPO3 Extension "Mail": The click tracking middleware accepts an arbitrary target URL and redirects to it

The click tracking middleware accepts an arbitrary target URL and redirects to it. Attackers can misuse links to the website to redirect users to external sites...

CVE-2026-121130: Google Chrome: Observable discrepancy in Forms in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive…

Observable discrepancy in Forms in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. Chromium security severity: Low...