CVE-2026-121182: Google Chrome: Use after free in DOM in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code…

Use after free in DOM in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-121187: Google Chrome: Observable discrepancy in Paint in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive…

Observable discrepancy in Paint in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-121189: Google Chrome: Use after free in Browser in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code…

Use after free in Browser in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Low...

CVE-2026-121209: Google Chrome: UI misrepresentation in Input in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to spoof address bar…

UI misrepresentation in Input in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to spoof address bar via a crafted HTML page. Chromium security severity: Low...

CVE-2026-121212: Google Chrome: Incorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin…

Incorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-121213: Google Chrome: Uninitialized resource in Images in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain…

Uninitialized resource in Images in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromium security severity: High...

CVE-2026-121220: Google Chrome: Incorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised…

Incorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-121226: Google Chrome: Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary…

Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-121522: moby BuildKit: In BuildKit versions v0.26.0 through v0.34.1, a specific build definition that resolves metadata for the same Git…

In BuildKit versions v0.26.0 through v0.34.1, a specific build definition that resolves metadata for the same Git source reference twice can cause the BuildKit daemon to panic and crash, interrupting builds handled by that daemon. The issue is fixed in v0.34.2...

CVE-2026-105982: Welotec: Improper input validation in the IPsec VPN function may allow a remote attacker with high privileges to inject system…

Improper input validation in the IPsec VPN function may allow a remote attacker with high privileges to inject system commands and execute them with root privileges...

CVE-2026-121517: n/a IrfanView: A vulnerability was detected in IrfanView 4.76.0.0 on Win64

A vulnerability was detected in IrfanView 4.76.0.0 on Win64. Affected by this vulnerability is an unknown functionality of the component TIFF Wang Annotation Handler. Performing a manipulation results in heap-based buffer overflow. The attack is possible to be carried out remotely. The complexity...

RHEL 8 : python-dns (RHSA-2026:94749)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:94749 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic da...

RHEL 9 : fence-agents (RHSA-2026:94523)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:94523 advisory. The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or...

Photon OS 5.0: Linux PHSA-2024-5.0-90-0305

An update of the linux package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2024-5.0-90-0305. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Linux Distros Unpatched Vulnerability : CVE-2026-121389

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP from 3.27.0 before 3.32.2 contains a denial of service vulnerability in rdpdrdumppacket that allows malicious RDP servers to abort clients by sending...

Logstash 8.12.1 < 8.19.24 / 9.0.x < 9.4.9 / 9.5.x < 9.5.6 Multiple Vulnerabilities (ESA-2026-228)

The version of Logstash installed on the remote host is 8.12.1 or later prior to 8.19.24, or 9.0.x prior to 9.4.9, or 9.5.x prior to 9.5.6. It is, therefore, affected by multiple vulnerabilities as referenced in the ESA-2026-228 advisory. - Vulnerability in the Oracle Java SE, Oracle GraalVM for...

AlmaLinux 9.2 [TuxCare] Security Update: log4j / log4j-jcl / log4j-slf4j / log4j-web (ALMALINUX9.2:CLSA-2026:1792624679)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1792624679 advisory. - The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer...

CVE-2026-99254: Linux: In the Linux kernel, the following vulnerability has been resolved: io_uring: don't flood a cancelling task with…

In the Linux kernel, the following vulnerability has been resolved: iouring: don't flood a cancelling task with taskwork ioringexitwork asks each task which has used the ring to remove its tctx node, by taskwork, and repeats that until the list is empty. iotctxexitcb doesn't touch the node while...

CVE-2026-99245: Linux: In the Linux kernel, the following vulnerability has been resolved: KEYS: Fix key_reject_and_link() race with keyring…

In the Linux kernel, the following vulnerability has been resolved: KEYS: Fix keyrejectandlink race with keyring restriction The restrictlink check in keyrejectandlink is done before taking the keyring semaphore, racing with a concurrent keyringrestrict that installs the restriction while holding...

CVE-2026-99255: Linux: In the Linux kernel, the following vulnerability has been resolved: io_uring/io-wq: don't hide a link from…

In the Linux kernel, the following vulnerability has been resolved: iouring/io-wq: don't hide a link from cancellations A task that exits cancels its tracked requests and waits until they are gone. iouringcancelgeneric looks everywhere a request can be, and goes to sleep if it found nothing to...