Google Chrome < 157.0.8103.38 Multiple Vulnerabilities

The version of Google Chrome installed on the remote Windows host is prior to 157.0.8103.38. It is, therefore, affected by multiple vulnerabilities as referenced in the 202611stable-channel-update-for-desktop advisory. - Use after free in TabStrip. CVE-2026-121114, CVE-2026-121257 - Missing...

CVE-2026-121555: DrizzleTime Foxel: Foxel through 2.4.0 contains a missing authentication vulnerability that allows unauthenticated attackers to read files…

Foxel through 2.4.0 contains a missing authentication vulnerability that allows unauthenticated attackers to read files by requesting the /api/fs/stream and /api/fs/thumb endpoints. Attackers can supply a VFS mount prefix and relative path to retrieve full file contents or thumbnails across all...

CVE-2026-104647: Unknown weMail: The weMail WordPress plugin through 2.1.6 does not correctly verify user capabilities in its REST API permission…

The weMail WordPress plugin through 2.1.6 does not correctly verify user capabilities in its REST API permission checks, treating any user whose role is in the weMail WordPress plugin through 2.1.6's allowed-roles list Editor and above by default as authorised for every action, which allows such...

CVE-2026-121517: n/a IrfanView: A vulnerability was detected in IrfanView 4.76.0.0 on Win64

A vulnerability was detected in IrfanView 4.76.0.0 on Win64. Affected by this vulnerability is an unknown functionality of the component TIFF Wang Annotation Handler. Performing a manipulation results in heap-based buffer overflow. The attack is possible to be carried out remotely. The complexity...

Google Chrome < 157.0.8103.38 Multiple Vulnerabilities

The version of Google Chrome installed on the remote macOS host is prior to 157.0.8103.38. It is, therefore, affected by multiple vulnerabilities as referenced in the 202611stable-channel-update-for-desktop advisory. - Use after free in TabStrip. CVE-2026-121114, CVE-2026-121257 - Missing...

CVE-2026-111754: angular: Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and…

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.33, 21.2.25, and 22.2.1, ServerPlatformLocation in Angular server-side rendering checks for protocol-relative URLs before WHATWG URL normalization. A...

CVE-2026-121036: Google Chrome: Use after free in CSS in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code…

Use after free in CSS in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-121041: Google Chrome: Missing authorization in Input in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive…

Missing authorization in Input in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. Chromium security severity: Low...

CVE-2026-121042: Google Chrome: Incorrect authorization in Permissions in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker…

Incorrect authorization in Permissions in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-121217: Google Chrome: Use after free in Streaming in Google Chrome prior to 157.0.8103.38 allowed an adjacent attacker to execute arbitrary…

Use after free in Streaming in Google Chrome prior to 157.0.8103.38 allowed an adjacent attacker to execute arbitrary code inside the sandbox via crafted network traffic. Chromium security severity: Low...

CVE-2026-121221: Google Chrome: Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary…

Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-121248: Google Chrome: Incorrect authorization in API in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system…

Incorrect authorization in API in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via a crafted Chrome extension. Chromium security severity: Medium...

CVE-2026-121253: Google Chrome: Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social…

Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass site isolation via a crafted Chrome extension. Chromium security severity: Low...

CVE-2026-121254: Google Chrome: Information leak in Select in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive…

Information leak in Select in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-95745: Hewlett Packard Enterprise (HPE) Fabric Composer: A vulnerability in the API of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to conduct…

A vulnerability in the API of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to conduct a denial of service attack. Successful exploitation could allow an attacker to cause the management services to become unavailable...

CVE-2026-95756: Hewlett Packard Enterprise (HPE) Fabric Composer: A command injection vulnerability exists in the API of HPE Networking Fabric Composer and could be exploited by an…

A command injection vulnerability exists in the API of HPE Networking Fabric Composer and could be exploited by an authenticated remote attacker with administrative privileges if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to ga...

CVE-2026-95763: Hewlett Packard Enterprise (HPE) Fabric Composer: An improper certificate validation vulnerability in HPE Networking Fabric Composer could allow an unauthenticated…

An improper certificate validation vulnerability in HPE Networking Fabric Composer could allow an unauthenticated remote attacker to access sensitive information if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to intercept...

CVE-2026-121509: n/a Headless CMS Plugin: A security flaw has been discovered in Headless CMS Plugin up to 2.0.4 on WordPress

A security flaw has been discovered in Headless CMS Plugin up to 2.0.4 on WordPress. This affects the function getrequiredpostdata of the file /wp-json/rae/v1/post of the component REST API. The manipulation of the argument postid/postslug results in information disclosure. The attack may be...

CVE-2026-121446: darylldoyle svg-sanitizer: svg-sanitizer from 0.5.0 before 1.1.0 contains an incomplete filtering vulnerability that allows attackers to bypass…

svg-sanitizer from 0.5.0 before 1.1.0 contains an incomplete filtering vulnerability that allows attackers to bypass remote URL removal by using CSS escape sequences inside url in SVG presentation attributes. Attackers can supply SVG files with attributes like fill containing escaped slashes that...

CVE-2026-121390: FreeRDP: FreeRDP 3.0.0 before 3.32.2 built with WITH_AAD=ON contains a reachable assertion because its ARM gateway response…

FreeRDP 3.0.0 before 3.32.2 built with WITHAAD=ON contains a reachable assertion because its ARM gateway response parser accepts a missing or non-string redirectedServerCert field and passes a null buffer to the certificate parser. A malicious or malformed user-selected gateway can return such a...