CVE-2026-76043

An incorrect calculation in the V8 JavaScript engine in Google Chrome prior to 151.0.7922.169 allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. The vulnerability requires user interaction (visiting a malicious page) but no prior authentication. CVSS 3....

EUVD-2026-61232

Buffer overflow in ANGLE in Google Chrome on on Android prior to 151.0.7922.169 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

EUVD-2026-61230

Inappropriate implementation in Media in Google Chrome on on Mac prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-76035

Inappropriate implementation in Media in Google Chrome on on Mac prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-76040

Use after free in Browser in Google Chrome on on Mac prior to 151.0.7922.169 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

EUVD-2026-61229

Use after free in Browser in Google Chrome on on Mac prior to 151.0.7922.169 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-76040

CVE-2026-76040 is a use-after-free vulnerability in the Browser component of Google Chrome (Chromium-based), affecting versions prior to 151.0.7922.169 on Mac. A remote attacker leveraging social engineering can execute arbitrary code outside the sandbox via a crafted HTML page. The CVSS 3.1 scor...

CVE-2026-76035

CVE-2026-76035 is an inappropriate implementation in the Media component of Google Chrome on Mac, prior to version 151.0.7922.169 . A remote attacker can execute arbitrary code outside the sandbox by convincing a user to open a crafted HTML page. The vulnerability was reported by Google on 2026-0...

CVE-2026-76037

CVE-2026-76037 is a link following vulnerability in the CredentialProvider component of Google Chrome on Windows , affecting versions prior to 151.0.7922.169 . A local attacker can potentially execute arbitrary code outside the sandbox via a local program. The Chromium security severity is High ,...

CVE-2026-76037

Link following in CredentialProvider in Google Chrome on on Windows prior to 151.0.7922.169 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. Chromium security severity: High...

CVE-2026-76034

Buffer overflow in WebGL in Google Chrome prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Critical...

CVE-2026-76034

Buffer overflow in WebGL in Google Chrome prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Critical...

CVE-2026-76034

Buffer overflow in WebGL in Google Chrome prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Critical...

CVE-2026-76034

CVE-2026-76034 is a critical buffer overflow in the WebGL component of Google Chrome prior to 151.0.7922.169 . A remote attacker can exploit this flaw via a crafted HTML page to execute arbitrary code outside the browser sandbox , enabling direct code execution on the underlying operating system....

CVE-2026-76036

Buffer overflow in Dawn in Google Chrome on on Android prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Critical...

MONAI: Unsafe deserialization in NumpyReader allows arbitrary code execution via malicious .npy files

Summary The NumpyReader class in monai/data/imagereader.py unconditionally uses np.loadname, allowpickle=True line 1276, enabling arbitrary code execution when loading a crafted .npy or .npz file. This affects all MONAI versions up to and including the latest commit 5b71547. The allowpickle...

jmespath.php has CompilerRuntime code injection via unescaped function names

Impact mtdowling/jmespath.php can generate and execute attacker-controlled PHP code when JmesPath\CompilerRuntime is used with an attacker-controlled JMESPath expression. The compiler emits parsed JMESPath function names into generated PHP source without sufficient escaping. A crafted expression...

CVE-2026-66783

A flaw was found in the submariner-operator component of Red Hat Advanced Cluster Management for Kubernetes. This vulnerability allows a cluster administrator, or any user with permissions to modify the Submariner Custom Resource CR, to specify an unvalidated image path. This lack of validation...

CVE-2026-66783 Submariner-operator: submariner-operator: arbitrary image override enables privileged code execution on every node

A flaw was found in the submariner-operator component of Red Hat Advanced Cluster Management for Kubernetes. This vulnerability allows a cluster administrator, or any user with permissions to modify the Submariner Custom Resource CR, to specify an unvalidated image path. This lack of validation...

CVE-2026-66783

A flaw in the submariner-operator component of Red Hat Advanced Cluster Management for Kubernetes allows a user with permissions to modify the Submariner Custom Resource (CR) to specify an unvalidated image path . This enables deployment of a malicious image, resulting in arbitrary code execution...