CVE-2026-121035: Google Chrome: Use after free in Prerender in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code…

Use after free in Prerender in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Critical...

CVE-2026-120833: NIST labbench: labbench before 0.46.1 contains a deserialization of untrusted data vulnerability in read() and read_relational() that…

labbench before 0.46.1 contains a deserialization of untrusted data vulnerability in read and readrelational that passes any file with a .p or .pickle extension to pandas.readpickle based on the extension alone. Attackers who supply a crafted data file or relational data archive can execute...

CVE-2026-121073: Google Chrome: Use after free in Network in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute…

Use after free in Network in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via crafted network traffic. Chromium security severity: Low...

CVE-2026-120954: MongoDB C Driver: A weakness in the BSON library's handling of a specialized binary vector data type allows an arithmetic wraparound when…

A weakness in the BSON library's handling of a specialized binary vector data type allows an arithmetic wraparound when computing the number of elements described by an oversized attacker-supplied value. On builds where the platform word size is 32 bits, an application that parses untrusted BSON...

CVE-2026-121091: Google Chrome: Incorrect authorization in Permissions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had…

Incorrect authorization in Permissions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-63434: franklioxygen MyTube: MyTube is a self-hosted downloader and player for several video websites

MyTube is a self-hosted downloader and player for several video websites. Prior to 1.10.6, when statisticsEnabled and statisticsTrackVisitorActivity are enabled, a visitor-role user can submit events to the statistics ingest endpoint handled by ingestEvents in...

CVE-2026-63436: zeroturnaround zt-zip: zt-zip is a Java library that provides convenience methods for ZIP archive manipulation

zt-zip is a Java library that provides convenience methods for ZIP archive manipulation. Prior to 1.18.0, the Zips.getzip.unpack.destinationoutputDir.process fluent API in src/main/java/org/zeroturnaround/zip/Zips.java constructs output files directly from ZIP entry names without applying the...

CVE-2026-63198: traPtitech traQ: traQ is a messenger application built for Digital Creators Club traP

traQ is a messenger application built for Digital Creators Club traP. Prior to 3.28.3, OAuth2 silent authorization requests using prompt=none with an empty or omitted scope parameter check prior consent against the empty requested scope set even though all scopes registered for the client become...

CVE-2026-63471: koxudaxi fastapi-code-generator: fastapi-code-generator creates FastAPI applications from OpenAPI files

fastapi-code-generator creates FastAPI applications from OpenAPI files. Prior to 0.8.1, the generator inserts an OpenAPI path into a generated @app.get... route decorator as a single-quoted generated route string without escaping embedded quotes. An attacker-controlled or attacker-influenced...

CVE-2026-63478: isomorphic-git: isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers

isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git's tree parser in src/models/GitTree.js accepts a standalone .. tree-entry name because it rejects only path separators. During clone or checkout from a malicious or...

CVE-2026-63501: Agamnentzar ag-psd: ag-psd is a JavaScript library for reading and writing Photoshop Document files

ag-psd is a JavaScript library for reading and writing Photoshop Document files. Prior to 31.0.3, readPsd accepts a totalMemoryLimit for parsing untrusted PSD files, but decodeLayerImageData expects a differently named memoryLimit property and therefore passes an undefined limit to...

CVE-2026-57154: opnsense core: OPNsense is a FreeBSD based firewall and routing platform

OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.11 and 26.4.1p1, authenticated Web UI or API users with delegated access to affected settings can submit CR or LF characters in fields expected to contain one line, causing generated privileged service configuration files to...

CVE-2026-55186: silverstripe silverstripe-mfa: Silverstripe MFA provides multi-factor authentication for Silverstripe CMS

Silverstripe MFA provides multi-factor authentication for Silverstripe CMS. Prior to 6.0.0, the CMS 5 password reset flow can issue a logged-in session after a user changes a password but before the user's configured multi-factor authentication challenge is completed. An attacker with access to t...

CVE-2026-61496: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2026-121628: bagisto: Bagisto before 2.3.16 and 2.4.x before 2.4.1 contains a race condition vulnerability in manageCartRule() that allows…

Bagisto before 2.3.16 and 2.4.x before 2.4.1 contains a race condition vulnerability in manageCartRule that allows attackers to redeem single-use coupons multiple times. Attackers can submit concurrent order requests to the onepage orders checkout endpoint, bypassing unlocked timesused checks to...

CVE-2026-121652: AWS maplibre-gl-js-amplify: Cross-site scripting (XSS) issue in AWS Amplify maplibre-gl-js-amplify before 4.0.3 might allow remote authenticated…

Cross-site scripting XSS issue in AWS Amplify maplibre-gl-js-amplify before 4.0.3 might allow remote authenticated users to inject arbitrary web script or HTML via the 1 title, 2 address, or 3 placename property in GeoJSON feature data rendered by popupRender, or the 4 geofenceId value rendered i...

CVE-2026-121539: miroslavpejic85 MiroTalk P2P: A vulnerability was found in miroslavpejic85 MiroTalk P2P up to 2.0.87/2.1.38

A vulnerability was found in miroslavpejic85 MiroTalk P2P up to 2.0.87/2.1.38. Affected by this issue is the function CheckPassword of the file app/src/server.js of the component Socket IO Handler. Performing a manipulation of the argument peerid results in improper access controls. It is possibl...

CVE-2026-28531: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2026-121520: Moby BuildKit: In BuildKit versions prior to v0.34.1, a malicious client with access to the BuildKit control APIs can submit a build…

In BuildKit versions prior to v0.34.1, a malicious client with access to the BuildKit control APIs can submit a build request that sets an extended attribute on a file outside the BuildKit state directory. Extended attributes in the trusted. or security. namespaces may also be set, potentially...

CVE-2026-121524: sumiie24 School-Management-System: A flaw has been found in sumiie24 School-Management-System up to d946d649c7c95e101fc5679ecd91999533bb10d7

A flaw has been found in sumiie24 School-Management-System up to d946d649c7c95e101fc5679ecd91999533bb10d7. Affected by this issue is some unknown functionality of the file parentLogin.php of the component Public Search Feature. Executing a manipulation of the argument email can lead to sql...