CVE-2026-121247: Google Chrome: Buffer overflow in Dawn in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially…

Buffer overflow in Dawn in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Critical...

CVE-2026-121250: Google Chrome: Use after free in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social…

Use after free in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted Chrome extension. Chromium security severity: High...

CVE-2026-95739: Hewlett Packard Enterprise (HPE) Fabric Composer: An improper restriction of excessive authentication attempts vulnerability in the API of HPE Networking Fabric Composer…

An improper restriction of excessive authentication attempts vulnerability in the API of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to conduct brute-force attacks against user accounts if certain preconditions outside of the attacker's control are met. Successfu...

CVE-2026-121122: Google Chrome: UI misrepresentation in Prompts in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social…

UI misrepresentation in Prompts in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-95722: Hewlett Packard Enterprise (HPE) Virtual Intranet Access (VIA): A local privilege escalation vulnerability has been discovered in the Virtual Intranet Access (VIA) client

A local privilege escalation vulnerability has been discovered in the Virtual Intranet Access VIA client. Successful exploitation of this vulnerability could allow a local attacker with low privileges to execute arbitrary commands with elevated privileges on the underlying operating system...

CVE-2025-71452: Vembu Technologies BDRSuite: Vembu BDRSuite before 7.6.0 contains an unauthenticated cross-site scripting vulnerability in…

Vembu BDRSuite before 7.6.0 contains an unauthenticated cross-site scripting vulnerability in templates/progress/clientside/restoreprogress.sgp that allows remote attackers to inject arbitrary JavaScript by manipulating request parameters such as mn, rnm, isRepliRestore, rusr, and rpwd that are...

CVE-2026-82159: Dell Wyse Management Suite: Dell Wyse Management Suite, versions prior to 2609.0.0.155, contain an Improper Neutralization of Input During Web Page…

Dell Wyse Management Suite, versions prior to 2609.0.0.155, contain an Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Script injection...

CVE-2026-121443: darylldoyle svg-sanitizer: svg-sanitizer from 1.1.0 before 1.1.1 contains a denial of service vulnerability that allows remote attackers to crash…

svg-sanitizer from 1.1.0 before 1.1.1 contains a denial of service vulnerability that allows remote attackers to crash requests by submitting SVG input ending inside an unclosed tag. Attackers can upload truncated input like a single '' to trigger an uncaught ValueError from strpos in...

CVE-2026-121733: Webkul Bagisto: Bagisto before 2.4.5 contains a stored cross-site scripting vulnerability that allows authenticated customers to upload…

Bagisto before 2.4.5 contains a stored cross-site scripting vulnerability that allows authenticated customers to upload HTML files via the RMA send-message endpoint without type or extension validation. Attackers can upload a .html attachment containing JavaScript served under...

CVE-2026-121193: Google Chrome: Incorrect authorization in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass…

Incorrect authorization in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via a crafted Chrome extension. Chromium security severity: Medium...

CVE-2026-121194: Google Chrome: Missing authorization in SiteIsolation in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had…

Missing authorization in SiteIsolation in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted PDF file. Chromium security severity: Medium...

CVE-2026-121580: Devolutions Server: Server-side request forgery in the Jira ticketing filter lookup in Devolutions Server 2026.2.22.0 and earlier allows an…

Server-side request forgery in the Jira ticketing filter lookup in Devolutions Server 2026.2.22.0 and earlier allows an authenticated low-privileged user to obtain the stored Jira service account credentials via an attacker-controlled server address in the request...

CVE-2026-121564: lucasrodes whatstk: Incomplete Comparison with Missing Factors (CWE-1023) in merge_chats() (whatstk/utils/chat_merge.py), reached from…

Incomplete Comparison with Missing Factors CWE-1023 in mergechats whatstk/utils/chatmerge.py, reached from BaseChat.merge, in whatstk from 0.3.0 before 0.9.0 allows a party that supplies the chat exports to cause messages to be absent from the merged output with no indication that anything was...

CVE-2026-121441: bytecodealliance wasmtime: Wasmtime before 36.0.19, 37.0.0 before 48.0.7, and 49.0.0 before 49.0.4 contains a request smuggling vulnerability in…

Wasmtime before 36.0.19, 37.0.0 before 48.0.7, and 49.0.0 before 49.0.4 contains a request smuggling vulnerability in wasi-http that allows guests to set multiple conflicting content-length headers. Malicious guests can make the host send HTTP requests with conflicting content-length values to...

CVE-2026-121452: mlogclub bbs-go: bbs-go through 4.4.6 contains an improper certificate validation vulnerability that allows network-positioned attackers…

bbs-go through 4.4.6 contains an improper certificate validation vulnerability that allows network-positioned attackers to intercept SMTP traffic because sendEmail sets InsecureSkipVerify to true. Attackers can present any certificate to capture SMTP PLAIN auth credentials and read or modify...

CVE-2026-99261: Linux: In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: correct reservation fence slots for…

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: correct reservation fence slots for userq per-vm BOs eviction It fixes both the move overflow and the eviction fence add for evicting these per-vm BOs...

CVE-2026-121181: Google Chrome: Use after free in Editing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code…

Use after free in Editing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-121231: Google Chrome: Incorrect authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system…

Incorrect authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. Chromium security severity: Medium...

AlmaLinux 9.6 [TuxCare] Security Update: gimp / gimp-devel / gimp-devel-tools / gimp-libs (ALMALINUX9.6:CLSA-2026:1793718255)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793718255 advisory. - A heap-based buffer overflow was found in GIMP's DirectDraw Surface DDS loader. When loading a crafted DDS image, buffer sizes derived from...

CVE-2026-121602: solanum-ircd solanum: Solanum before commit 2ce64de contains a heap-based buffer overflow vulnerability that allows a malicious linked server…

Solanum before commit 2ce64de contains a heap-based buffer overflow vulnerability that allows a malicious linked server to corrupt memory by sending overlong channel names in JOIN or SJOIN messages. Attackers controlling a peer server can trigger strcpy and sprintf overflows in msjoin and mssjoin...