CVE-2026-121174: Google Chrome: Missing authorization in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass…

Missing authorization in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: High...

CVE-2026-121184: Google Chrome: Out of bounds read in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute…

Out of bounds read in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-121196: Google Chrome: Privilege elevation in Mobile in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker to bypass…

Privilege elevation in Mobile in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions into a privileged page via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-121203: Google Chrome: Use after free in Geometry in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code…

Use after free in Geometry in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Critical...

CVE-2026-121215: Google Chrome: UI misrepresentation in Bluetooth in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to spoof UI…

UI misrepresentation in Bluetooth in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to spoof UI elements via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-121222: Google Chrome: Incorrect authorization in Forms in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin…

Incorrect authorization in Forms in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Low...

CVE-2026-121244: Google Chrome: UI misrepresentation in FileAPI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social…

UI misrepresentation in FileAPI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-13594: Zohocorp: Zoho Corporation's ManageEngine Log360 and EventLog Analyzer versions 13062 and below are vulnerable to an issue that…

Zoho Corporation's ManageEngine Log360 and EventLog Analyzer versions 13062 and below are vulnerable to an issue that could allow an adversary to gain unauthorized access to the product...

CVE-2026-121166: Google Chrome: Type confusion in PDFium in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code…

Type confusion in PDFium in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted PDF file. Chromium security severity: High...

CVE-2026-39379: geonetwork core-geonetwork: GeoNetwork is a catalog application to manage spatially referenced resources

GeoNetwork is a catalog application to manage spatially referenced resources. From 3.0.0 until 4.2.15 and 4.4.10, requesting a nonexistent or unauthorized service URL can cause an error page to reflect attacker-controlled request content inside an AngularJS application without adequately...

CVE-2026-95770: Hewlett Packard Enterprise (HPE) Fabric Composer: A sensitive information disclosure vulnerability in the underlying operating system of HPE Networking Fabric Composer…

A sensitive information disclosure vulnerability in the underlying operating system of HPE Networking Fabric Composer could allow an authenticated low-privileged user with local access to view sensitive information, if certain preconditions outside of the attacker's control are met. Successful...

CVE-2026-120673: MongoDB Rust Driver: A component of the MongoDB Rust Driver that records diagnostic tracing data can capture command content before…

A component of the MongoDB Rust Driver that records diagnostic tracing data can capture command content before automatic client-side field level encryption is applied. In deployments that turn on the optional tracing capability together with automatic in-use encryption, a party with read access t...

CVE-2026-121734: zane-ops: ZaneOps 1.14.0 before 1.15.2 contains an authorization bypass vulnerability that allows any workspace administrator to…

ZaneOps 1.14.0 before 1.15.2 contains an authorization bypass vulnerability that allows any workspace administrator to read another workspace's pending preview environment by querying ReviewPreviewEnvDeployAPIView without project scoping. Attackers can use the project slug and environment name fr...

CVE-2026-121509: n/a Headless CMS Plugin: A security flaw has been discovered in Headless CMS Plugin up to 2.0.4 on WordPress

A security flaw has been discovered in Headless CMS Plugin up to 2.0.4 on WordPress. This affects the function getrequiredpostdata of the file /wp-json/rae/v1/post of the component REST API. The manipulation of the argument postid/postslug results in information disclosure. The attack may be...

CVE-2026-121581: n/a ArcReel: A vulnerability has been found in ArcReel 0.32.0/0.33.0/0.34.0

A vulnerability has been found in ArcReel 0.32.0/0.33.0/0.34.0. The impacted element is an unknown function of the file /api/v1/providers/id/test of the component Provider Test-Connection Endpoint. The manipulation leads to server-side request forgery. Remote exploitation of the attack is possibl...

CVE-2026-121216: Google Chrome: UI misrepresentation in UI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social…

UI misrepresentation in UI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. Chromium security severity: Medium...

Oracle Linux 10 : fence-agents (ELSA-2026-94501)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-94501 advisory. 4.16.0-21.7 - bundled PyJWT: upgrade to v2.15.1 to fix CVE-2026-102266, CVE-2026-102267, CVE-2026-102268, CVE-2026-102271, and CVE-2026-102272...

CVE-2026-121531: n/a Umami: A vulnerability has been found in Umami 3.3.x/3.4.0/3.4.1

A vulnerability has been found in Umami 3.3.x/3.4.0/3.4.1. This affects an unknown part of the file src/app/api/auth/login/route.ts of the component 2FA Policy Handler. The manipulation leads to use of single-factor authentication. It is possible to initiate the attack remotely. The exploit has...

RHEL 10 / 8 / 9 : Red Hat JBoss Web Server 7.0.3 (RHSA-2026:93618)

The remote Redhat Enterprise Linux 10 / 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:93618 advisory. Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised ...

RHEL 10 / 9 : Red Hat Edge Manager Version 1.2.2 Security Update (Important) (RHSA-2026:94632)

The remote Redhat Enterprise Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:94632 advisory. Red Hat Edge Manager RHEM provides simple, scalable, and security-focused management of edge devices and applications. It supports...