CVE-2026-121229: Google Chrome: Memory corruption in ANGLE in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to…

Memory corruption in ANGLE in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Critical...

CVE-2026-121230: Google Chrome: Race condition in ANGLE in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute…

Race condition in ANGLE in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Low...

CVE-2026-104648: Unknown weMail: The weMail WordPress plugin through 2.1.6 does not restrict a site-wide third-party email-service API key to…

The weMail WordPress plugin through 2.1.6 does not restrict a site-wide third-party email-service API key to administrators, exposing it in an admin screen that users with the Editor role can reach by default, which allows them to obtain a reusable credential usable without a WordPress session to...

CVE-2026-121548: jarun nnn: Jarun nnn through 5.3 contains an OS command injection vulnerability in plugins/togglex that allows attackers to…

Jarun nnn through 5.3 contains an OS command injection vulnerability in plugins/togglex that allows attackers to execute commands via crafted filenames. Attackers can place files whose names contain a double quote and shell syntax, which xargs -I splices into an sh -c script, running commands as...

CVE-2026-65139: NVIDIA Slurm: NVIDIA Slurm contains an attacker-controlled SQL injection attack in certain SlurmDBD RPCs that can lead to arbitrary…

NVIDIA Slurm contains an attacker-controlled SQL injection attack in certain SlurmDBD RPCs that can lead to arbitrary code execution...

CVE-2026-121510: D3TN GmbH µD3TN: Remote Unauthenticated Heap Out-of-Bounds Write in µD3TN BPv6 Administrative Record Parser allows Unauthenticated…

Remote Unauthenticated Heap Out-of-Bounds Write in µD3TN BPv6 Administrative Record Parser allows Unauthenticated Remote Attacker to Reliably Cause DoS...

CVE-2026-108147: djangoproject Django: An issue was discovered in Django 6.1 before 6.1.3, 6.0.4 before 6.0.10, and 5.2.13 before 5.2.19

An issue was discovered in Django 6.1 before 6.1.3, 6.0.4 before 6.0.10, and 5.2.13 before 5.2.19. django.http.multipartparser.MultiPartParser is subject to excessive memory consumption when processing multipart file uploads with base64 Content-Transfer-Encoding, which could be buffered entirely ...

CVE-2026-121444: darylldoyle svg-sanitizer: svg-sanitizer from 0.11.0 before 1.1.0 contains an algorithmic complexity denial of service vulnerability in…

svg-sanitizer from 0.11.0 before 1.1.0 contains an algorithmic complexity denial of service vulnerability in hasInfiniteLoop and countUse of the use reference-graph analysis. Attackers can upload a small layered SVG with 15 levels of fanned-out use elements, forcing exponential path enumeration...

CVE-2026-108053: AM System ALO Suite: A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality

A stored Cross-Site Scripting XSS vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation require...

CVE-2026-99246: Linux: In the Linux kernel, the following vulnerability has been resolved: tipc: protect node reset trace dump with node lock…

In the Linux kernel, the following vulnerability has been resolved: tipc: protect node reset trace dump with node lock The tipcnoderesetlinks trace event asks tipcnodedump to walk the node's link entries. Unlike the other node events that request link data, this event runs without the node lock...

CVE-2026-120572: Mozilla Firefox: Incorrect boundary conditions in the Layout: Block and Inline component

Incorrect boundary conditions in the Layout: Block and Inline component. This vulnerability was fixed in Firefox 159.0.1...

CVE-2026-99263: Linux: In the Linux kernel, the following vulnerability has been resolved: io_uring/poll: avoid retry wakeup loss when…

In the Linux kernel, the following vulnerability has been resolved: iouring/poll: avoid retry wakeup loss when dropping ownership If a wakeup sets IOPOLLRETRYFLAG between the owning task consuming the existing instance of IOPOLLRETRYFLAG and the loop check of iopollcheckevents, then we stall on...

CVE-2026-108057: AM System ALO Suite: A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality

A stored Cross-Site Scripting XSS vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation require...

CVE-2026-121549: jarun nnn: nnn through 5.3 contains an insecure temporary file vulnerability in the pdfread and nuke plugins that allows local…

nnn through 5.3 contains an insecure temporary file vulnerability in the pdfread and nuke plugins that allows local attackers to overwrite files by exploiting predictable paths in /tmp. Attackers can pre-create a symlink at the name-derived or PID-derived path so the victim's plugin truncates and...

CVE-2026-121401: FreeRDP: FreeRDP before 3.32.2 contains a denial of service vulnerability where rdg_process_packet dispatches a…

FreeRDP before 3.32.2 contains a denial of service vulnerability where rdgprocesspacket dispatches a PKTTYPEEXTENDEDAUTHMSG without verifying negotiated mode or auth context. A malicious or compromised RD Gateway can send the extended-auth packet before tunnel authentication, triggering a...

CVE-2026-121392: FreeRDP: FreeRDP before 3.32.2 contains an improper certificate validation vulnerability in tls_verify_certificate() that…

FreeRDP before 3.32.2 contains an improper certificate validation vulnerability in tlsverifycertificate that accepts Common Name fallback despite non-matching SAN entries and matches IP literals against DNS strings. Man-in-the-middle attackers holding a certificate from a client-trusted CA can...

CVE-2026-65165: NVIDIA Slurm: NVIDIA Slurm contains a vulnerability where a user could deliberately alter the provided nodelist alongside the…

NVIDIA Slurm contains a vulnerability where a user could deliberately alter the provided nodelist alongside the --distribution=arbitrary option to gain access to compute nodes outside of the current job allocation...

CVE-2026-121559: glpi-project GLPI: GLPI 10.0.0 before 10.0.28 and 11.0.0 before 11.0.10 contains a privilege escalation vulnerability that allows…

GLPI 10.0.0 before 10.0.28 and 11.0.0 before 11.0.10 contains a privilege escalation vulnerability that allows authenticated users to obtain elevated profiles by cloning accounts. A user with the Technician profile can clone a Super-Admin account with a new login and password, since...

CVE-2026-118488: Eclipse Foundation Eclipse Vert.x: In Eclipse Vert.x versions [4.0.0, 4.5.35] or [5.0.0, 5.2.2], when a malicious server keeps sending bytes on an…

In Eclipse Vert.x versions 4.0.0, 4.5.35 or 5.0.0, 5.2.2, when a malicious server keeps sending bytes on an EOL-terminated line not length-prefixed, for example a simple string 1, we'll keep growing the buffer without bounds, eventually leading to an OOM. We need to have a configurable limit for...

CVE-2026-121427: AzuraCast: AzuraCast through 0.23.8 fails to remove frontend_config.custom_config in PUT /station/{id}/profile/edit for users…

AzuraCast through 0.23.8 fails to remove frontendconfig.customconfig in PUT /station/id/profile/edit for users lacking the Manage station broadcasting permission, and the stored JSON is written verbatim as key=value lines into the Shoutcast scserv.conf file. An authenticated user with only the...