CVE-2026-121126: Google Chrome: Use after free in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute…

Use after free in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Critical...

CVE-2026-88968: anthropics claude-code: Claude Code is an agentic coding tool

Claude Code is an agentic coding tool. Prior to 2.1.251, the Edit tool validates a target using pathname and symlink resolution that is not bound to the underlying directory inode or file descriptor. On macOS, attacker-controlled code running in the Bash sandbox can atomically replace an...

CVE-2026-93325: Docker Docker Buildx: Buildx bake requires the user to grant entitlements with --allow or an interactive prompt before a build reaches…

Buildx bake requires the user to grant entitlements with --allow or an interactive prompt before a build reaches outside the working directory. Under --progress=rawjson that consent step is skipped...

CVE-2026-121114: Google Chrome: Use after free in TabStrip in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code…

Use after free in TabStrip in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-103429: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2026-118447: Bitdefender pybddisasm: A use of uninitialized memory vulnerability in the pybddisasm Python bindings may disclose process memory when…

A use of uninitialized memory vulnerability in the pybddisasm Python bindings may disclose process memory when instruction decoding fails. The nddecode, nddecodeex, nddecodeex2, and nddecodewithcontext functions may return an INSTRUX object whose contents have not been initialized after an...

CVE-2026-121049: Google Chrome: Out of bounds read in V8 in Google Chrome prior to 157.0.8103.38 allowed a local attacker to read memory via a crafted…

Out of bounds read in V8 in Google Chrome prior to 157.0.8103.38 allowed a local attacker to read memory via a crafted file. Chromium security severity: Medium...

CVE-2026-121207: Google Chrome: Uninitialized resource in Dawn in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker to read…

Uninitialized resource in Dawn in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-121541: Docker Docker Buildx: In Docker Buildx versions v0.19.0 through v0.38.0, an untrusted Bake definition that builds multiple targets together…

In Docker Buildx versions v0.19.0 through v0.38.0, an untrusted Bake definition that builds multiple targets together may expose files accessible to the Buildx client without the expected fs.read approval. Under certain conditions, filesystem paths from some targets are not verified against the...

CVE-2026-105982: Welotec: Improper input validation in the IPsec VPN function may allow a remote attacker with high privileges to inject system…

Improper input validation in the IPsec VPN function may allow a remote attacker with high privileges to inject system commands and execute them with root privileges...

CVE-2026-121041: Google Chrome: Missing authorization in Input in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive…

Missing authorization in Input in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. Chromium security severity: Low...

CVE-2026-121218: Google Chrome: Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside…

Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-121108: Google Chrome: Confused deputy in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially…

Confused deputy in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-120544: kodezen: The Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning plugin for WordPress is vulnerable to Directory…

The Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.0.1 via the 'id' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to read...

CVE-2026-121436: froxlor: Froxlor from 2.3.8 before 2.3.15 contains an information disclosure vulnerability that allows administrators with…

Froxlor from 2.3.8 before 2.3.15 contains an information disclosure vulnerability that allows administrators with customersseeall to view every account's API key and secret through an unscoped WHERE 1 query in apikeys.php. Attackers can read the super administrator's apikey and secret from the...

CVE-2026-99256: Linux: In the Linux kernel, the following vulnerability has been resolved: dm cache: fix issue with background work locking dm…

In the Linux kernel, the following vulnerability has been resolved: dm cache: fix issue with background work locking dm cache used a rwsemaphore for backgroundworklock. Write locks on rwsemaphores have strict owner semantics, but there was no guarantee that the process that locked...

CVE-2026-114582: djangoproject Django: An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19

An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. django.contrib.gis.gdal.SpatialReference and related transform methods and srs/srid setters do not restrict GDAL’s file and network access when parsing string input, which allows attackers to trigger...

CVE-2026-99258: Linux: In the Linux kernel, the following vulnerability has been resolved: x86/hyperv: Avoid using per-cpu output page in…

In the Linux kernel, the following vulnerability has been resolved: x86/hyperv: Avoid using per-cpu output page in hvapicidtovpindex hvapicidtovpindex currently uses the per-cpu hypercall input and output pages. This function is called when running in VTL2 and when running in an SEV-SNP CoCo VM...

CVE-2026-121231: Google Chrome: Incorrect authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system…

Incorrect authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-121232: Google Chrome: Incorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a local attacker leveraging social…

Incorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a local attacker leveraging social engineering to obtain sensitive information via a co-installed app. Chromium security severity: Low...