CVE-2026-121135: Google Chrome: Security issue in Platform in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin…

Security issue in Platform in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-121235: Google Chrome: Information leak in Paint in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive…

Information leak in Paint in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. Chromium security severity: Low...

CVE-2026-118445: Bitdefender pybddisasm: A use-after-free vulnerability in the pybddisasm Python bindings affects structure-valued members of INSTRUX objects

A use-after-free vulnerability in the pybddisasm Python bindings affects structure-valued members of INSTRUX objects. These members are exposed through Python objects that reference memory owned by the parent INSTRUX object. A retained reference to a member does not keep the parent allocation...

CVE-2026-108054: AM System ALO Suite: A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality

A stored Cross-Site Scripting XSS vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation require...

CVE-2026-121429: AzuraCast: AzuraCast through 0.23.8 contains a command injection vulnerability that allows station users with Profile permission…

AzuraCast through 0.23.8 contains a command injection vulnerability that allows station users with Profile permission to execute OS commands via StereoTool settings. Attackers can inject shell metacharacters into stereotoolconfigurationpath or stereotoollicensekey, which are executed via /bin/sh ...

CVE-2026-120831: Red Hat: A flaw was found in libslirp in if_output()

A flaw was found in libslirp in ifoutput. When moving a session from the fast queue to the batch queue, the code unlinked and reinserted an arbitrary packet via ifm-mnextpkt instead of the session queue head, corrupting queue pointers. A guest generating burst traffic could crash the host...

CVE-2026-4052: WSO2: This issue only impacts deployments where WSO2 Identity Server is configured as a Resident Key Manager with database…

This issue only impacts deployments where WSO2 Identity Server is configured as a Resident Key Manager with database sharing. In such environments, a self-registered user may gain access to the System REST APIs of WSO2 API Manager by obtaining a token from the WSO2 Identity Server token endpoint...

CVE-2026-13594: Zohocorp: Zoho Corporation's ManageEngine Log360 and EventLog Analyzer versions 13062 and below are vulnerable to an issue that…

Zoho Corporation's ManageEngine Log360 and EventLog Analyzer versions 13062 and below are vulnerable to an issue that could allow an adversary to gain unauthorized access to the product...

CVE-2026-121195: Google Chrome: Incorrect authorization in TrustedTypes in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web…

Incorrect authorization in TrustedTypes in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Low...

CVE-2026-77799: Zohocorp ManageEngine Key Manager Plus: ManageEngine Key Manager Plus versions before 7150 are vulnerable to a Two-Factor Authentication bypass that allows…

ManageEngine Key Manager Plus versions before 7150 are vulnerable to a Two-Factor Authentication bypass that allows attackers with valid credentials to log in without a verification code...

CVE-2026-121453: dataease SQLBot: SQLBot through 1.10.3 contains a path traversal vulnerability in the importToDb endpoint that allows authenticated…

SQLBot through 1.10.3 contains a path traversal vulnerability in the importToDb endpoint that allows authenticated workspace administrators to read files via an unsanitized filePath parameter. Attackers can supply absolute paths or ../ sequences to import CSV or spreadsheet files, including other...

CVE-2026-39743: WC Lovers WCFM Membership: Missing Authorization vulnerability in WC Lovers WCFM Membership wc-multivendor-membership allows Exploiting…

Missing Authorization vulnerability in WC Lovers WCFM Membership wc-multivendor-membership allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WCFM Membership: from n/a through 2.12.0...

CVE-2026-39379: geonetwork core-geonetwork: GeoNetwork is a catalog application to manage spatially referenced resources

GeoNetwork is a catalog application to manage spatially referenced resources. From 3.0.0 until 4.2.15 and 4.4.10, requesting a nonexistent or unauthorized service URL can cause an error page to reflect attacker-controlled request content inside an AngularJS application without adequately...

CVE-2026-116859: WPMU DEV Forminator: Missing Authorization vulnerability in WPMU DEV Forminator forminator allows Exploiting Incorrectly Configured Access…

Missing Authorization vulnerability in WPMU DEV Forminator forminator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Forminator: from n/a through 1.58.3...

CVE-2026-115716: Elastic APM Server: Allocation of Resources Without Limits or Throttling (CWE-770) in APM Server can lead to denial of service via…

Allocation of Resources Without Limits or Throttling CWE-770 in APM Server can lead to denial of service via Oversized Serialized Data Payloads CAPEC-231. An attacker who can send OpenTelemetry OTLP data to APM Server over HTTP can cause APM Server to exhaust its memory and terminate. This stops...

CVE-2026-119922: AWS babelfish-for-postgresql: Improper access control in the Babelfish for PostgreSQL extension versions 1.2-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8,…

Improper access control in the Babelfish for PostgreSQL extension versions 1.2-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 may allow remote authenticated users to elevate their privileges. To remediate this issue, we recommend you upgrade to Babelfish for PostgreSQL extension versions 4.10, 5.6, 6....

CVE-2026-85033: zephyrproject zephyr: The AVRCP Target role in subsys/bluetooth/host/classic/avrcp.c keeps its vendor-dependent response transmit state in a…

The AVRCP Target role in subsys/bluetooth/host/classic/avrcp.c keeps its vendor-dependent response transmit state in a per-connection object selected by connection index getavrcptg, with the per-transfer context tid, sentlen, and the BTAVRCPTGFLAGTXONGOING flag stored in the userdata of the queue...

CVE-2026-121024: AxxonSoft AxxonNet: Incorrect Authorization (CWE-863) in the Health Monitoring service in AxxonSoft AxxonNet before 3.28.0 on Linux allows…

Incorrect Authorization CWE-863 in the Health Monitoring service in AxxonSoft AxxonNet before 3.28.0 on Linux allows a remote attacker in possession of a shared report token, which is intended for read-only access, to create, modify or delete monitoring alerts via the monitoring API...

CVE-2026-120754: The HDF Group Scale-Offset Filter: HDF5 through 2.2.0 contains an uninitialized memory read vulnerability in H5Z__filter_scaleoffset() in…

HDF5 through 2.2.0 contains an uninitialized memory read vulnerability in H5Zfilterscaleoffset in src/H5Zscaleoffset.c. The decode path validates reads against the allocated size of the chunk buffer rather than the number of bytes actually read from the file. Because H5Dchunklock deliberately siz...

CVE-2026-120328: TYPO3 Extension "Mail": The click tracking middleware does not validate the authentication code of a recipient if the code is omitted

The click tracking middleware does not validate the authentication code of a recipient if the code is omitted. Unauthenticated attackers can retrieve personal data of newsletter recipients, which is inserted into links of sent mails...