CVE-2026-121158: Google Chrome: Information leak in Paint in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive…

Information leak in Paint in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-121176: Google Chrome: Uninitialized resource in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory inside…

Uninitialized resource in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-121167: Google Chrome: Incorrect authorization in Permissions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had…

Incorrect authorization in Permissions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-107916: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2026-108516: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2022-30267: Emerson Ovation: Emerson Ovation was found to have no authentication of firmware signing and relies on an insecure checksum for integrity

Emerson Ovation was found to have no authentication of firmware signing and relies on an insecure checksum for integrity. This could allow an attacker to push malicious firmware images, cause a denial-of-service condition, or achieve remote code execution...

CVE-2026-105821: TP-Link Systems Inc. Tapo Cloud Service: The Tapo Cloud MQTT broker contains a broken access control vulnerability in a proxy topic used by authenticated Tapo…

The Tapo Cloud MQTT broker contains a broken access control vulnerability in a proxy topic used by authenticated Tapo devices to request service tokens. The broker does not verify that the device ID supplied in a proxy request belongs to the authenticated device. An attacker who owns a Tapo devic...

CVE-2026-105993: Unknown DT Directory Lite Addon: The DT Directory Lite Addon WordPress plugin through 1.1 does not perform nonce or capability checks on its settings…

The DT Directory Lite Addon WordPress plugin through 1.1 does not perform nonce or capability checks on its settings handlers, allowing unauthenticated attackers to modify the DT Directory Lite Addon WordPress plugin through 1.1's configuration and skin options...

CVE-2026-95726: Hewlett Packard Enterprise (HPE) Virtual Intranet Access (VIA): A buffer overflow vulnerability in HPE Networking VIA could allow an unauthenticated remote attacker to conduct a…

A buffer overflow vulnerability in HPE Networking VIA could allow an unauthenticated remote attacker to conduct a denial of service attack. Successful exploitation could allow an attacker to interrupt the normal operation of the affected client...

CVE-2026-107441: Zyxel: An out-of-bounds write vulnerability in the CGI program of Zyxel GS1900-24E firmware versions through 2.90(AAHK.2)C0…

An out-of-bounds write vulnerability in the CGI program of Zyxel GS1900-24E firmware versions through 2.90AAHK.2C0 could allow an unauthenticated adjacent attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request...

CVE-2026-121050: Google Chrome: Race condition in Mobile in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker to bypass web…

Race condition in Mobile in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Low...

PHP File Write Verification Scanner

A Metasploit auxiliary scanner verifies a dedicated PHP endpoint's file-write proof by posting a random token and validating the returned content...

CVE-2026-63470: koxudaxi fastapi-code-generator: fastapi-code-generator creates FastAPI applications from OpenAPI files

fastapi-code-generator creates FastAPI applications from OpenAPI files. Prior to 0.8.1, the generator inserts Operation.summary into a generated route-handler docstring as a triple-double-quoted string without escaping embedded triple quotes. An attacker-controlled or attacker-influenced operatio...

CVE-2026-95728: Hewlett Packard Enterprise (HPE) Virtual Intranet Access (VIA): An arbitrary file write vulnerability exists in the Virtual Intranet Access (VIA) client

An arbitrary file write vulnerability exists in the Virtual Intranet Access VIA client. Successful exploitation could allow a local attacker with low privileges to escalate privileges on the affected system...

CVE-2026-121197: Google Chrome: Out of bounds read in ANGLE in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker to read memory…

Out of bounds read in ANGLE in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-121735: blueprintue blueprintue-self-hosted-edition: blueprintUE self-hosted edition before 4.3.4 contains an insufficient session expiration vulnerability that allows…

blueprintUE self-hosted edition before 4.3.4 contains an insufficient session expiration vulnerability that allows attackers to confirm accounts using stale tokens because UserModel::findUserIDWithConfirmedToken ignores confirmedsentat. Attackers who obtain an old confirmation link from a...

CVE-2026-121577: lucasrodes whatstk: Inefficient Regular Expression Complexity (CWE-1333) in generate_regex() (whatstk/whatsapp/parser.py) in whatstk from…

Inefficient Regular Expression Complexity CWE-1333 in generateregex whatstk/whatsapp/parser.py in whatstk from 0.2.0 before 0.9.0 allows a party that supplies a chat export to consume the CPU of the process that parses it for an unbounded time, because the function builds the header regular...

CVE-2026-110826: team-alembic ash_authentication: Improper Session Invalidation after Authentication Credential Change vulnerability in team-alembic ash_authentication…

Improper Session Invalidation after Authentication Credential Change vulnerability in team-alembic ashauthentication allows an attacker holding a victim's session token to stay signed in after the victim resets or changes their password. With applyonpasswordchange? true,...

CVE-2026-121061: Google Chrome: Use after free in Modularization in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary…

Use after free in Modularization in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-120715: Devolutions Server: Server-side request forgery in the Active Directory credential validation in Devolutions Server 2026.3.12.0 and earlier…

Server-side request forgery in the Active Directory credential validation in Devolutions Server 2026.3.12.0 and earlier allows an authenticated low-privileged user to capture the NetNTLMv2 hash of the DVLS service account via an attacker-controlled domain name in the request...