CVE-2026-121050: Google Chrome: Race condition in Mobile in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker to bypass web…

Race condition in Mobile in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Low...

PHP File Write Verification Scanner

A Metasploit auxiliary scanner verifies a dedicated PHP endpoint's file-write proof by posting a random token and validating the returned content...

CVE-2026-63470: koxudaxi fastapi-code-generator: fastapi-code-generator creates FastAPI applications from OpenAPI files

fastapi-code-generator creates FastAPI applications from OpenAPI files. Prior to 0.8.1, the generator inserts Operation.summary into a generated route-handler docstring as a triple-double-quoted string without escaping embedded triple quotes. An attacker-controlled or attacker-influenced operatio...

CVE-2026-95728: Hewlett Packard Enterprise (HPE) Virtual Intranet Access (VIA): An arbitrary file write vulnerability exists in the Virtual Intranet Access (VIA) client

An arbitrary file write vulnerability exists in the Virtual Intranet Access VIA client. Successful exploitation could allow a local attacker with low privileges to escalate privileges on the affected system...

CVE-2026-121197: Google Chrome: Out of bounds read in ANGLE in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker to read memory…

Out of bounds read in ANGLE in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-121735: blueprintue blueprintue-self-hosted-edition: blueprintUE self-hosted edition before 4.3.4 contains an insufficient session expiration vulnerability that allows…

blueprintUE self-hosted edition before 4.3.4 contains an insufficient session expiration vulnerability that allows attackers to confirm accounts using stale tokens because UserModel::findUserIDWithConfirmedToken ignores confirmedsentat. Attackers who obtain an old confirmation link from a...

CVE-2026-121577: lucasrodes whatstk: Inefficient Regular Expression Complexity (CWE-1333) in generate_regex() (whatstk/whatsapp/parser.py) in whatstk from…

Inefficient Regular Expression Complexity CWE-1333 in generateregex whatstk/whatsapp/parser.py in whatstk from 0.2.0 before 0.9.0 allows a party that supplies a chat export to consume the CPU of the process that parses it for an unbounded time, because the function builds the header regular...

CVE-2026-110826: team-alembic ash_authentication: Improper Session Invalidation after Authentication Credential Change vulnerability in team-alembic ash_authentication…

Improper Session Invalidation after Authentication Credential Change vulnerability in team-alembic ashauthentication allows an attacker holding a victim's session token to stay signed in after the victim resets or changes their password. With applyonpasswordchange? true,...

CVE-2026-121061: Google Chrome: Use after free in Modularization in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary…

Use after free in Modularization in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-120715: Devolutions Server: Server-side request forgery in the Active Directory credential validation in Devolutions Server 2026.3.12.0 and earlier…

Server-side request forgery in the Active Directory credential validation in Devolutions Server 2026.3.12.0 and earlier allows an authenticated low-privileged user to capture the NetNTLMv2 hash of the DVLS service account via an attacker-controlled domain name in the request...

CVE-2026-121099: Google Chrome: Information leak in PrivateTokens in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive…

Information leak in PrivateTokens in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-116669: Tanium Discover: Tanium addressed an improper access controls vulnerability in Discover.

Tanium addressed an improper access controls vulnerability in Discover...

CVE-2026-106004: Unknown DT LMS: The DT LMS WordPress plugin through 1.2 does not perform capability or nonce checks on one of its AJAX actions,…

The DT LMS WordPress plugin through 1.2 does not perform capability or nonce checks on one of its AJAX actions, allowing unauthenticated attackers to revoke any learner's course and class completion status...

CVE-2026-95860: node-opcua: node-opcua is an OPC UA implementation for TypeScript and Node.js

node-opcua is an OPC UA implementation for TypeScript and Node.js. From 2.42.0 until 2.180.0, namespace-level access control configured through setDefaultRolePermissions is not honored by the runtime enforcement path for nodes without explicit per-node RolePermissions...

CVE-2026-95730: Hewlett Packard Enterprise (HPE) Virtual Intranet Access (VIA): A buffer overflow vulnerability exists in HPE Networking VIA that could allow an authenticated low-privileged local…

A buffer overflow vulnerability exists in HPE Networking VIA that could allow an authenticated low-privileged local user to cause a denial of service. Successful exploitation could allow an attacker to interrupt the normal operation of the affected system...

CVE-2026-111464: emrevona WP Fastest Cache – WordPress Cache Plugin: The WP Fastest Cache plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and…

The WP Fastest Cache plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.5.3. The plugin caches the response of Core’s wp-activate.php without honoring its no-store/no-cache headers, the wp-activate- cookie, or the WPINSTALLING state, writi...

CVE-2026-46487: geonetwork core-geonetwork: GeoNetwork is a catalog application to manage spatially referenced resources

GeoNetwork is a catalog application to manage spatially referenced resources. From 4.0.0-alpha.1 until 4.2.16 and 4.4.11, the Elasticsearch-backed search proxy can skip GeoNetwork's access-control filter injection when a client request has an omitted query field. The request is then forwarded to...

CVE-2026-121242: Google Chrome: Improper input validation in WebPackaging in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass…

Improper input validation in WebPackaging in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via crafted network traffic. Chromium security severity: Medium...

CVE-2026-121097: Google Chrome: Use after free in Printing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code…

Use after free in Printing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-105980: Welotec: Improper input validation in the WireGuard VPN function may allow a remote attacker with high privileges to inject…

Improper input validation in the WireGuard VPN function may allow a remote attacker with high privileges to inject system commands and execute them with root privileges...