CVE-2026-113008

A flaw was found in the Transactions Platform in Google Chrome. A remote attacker can exploit this memory corruption vulnerability by enticing a user to visit a specially crafted HTML page. Successful exploitation may allow the attacker to execute arbitrary code within the browser's restricted...

CVE-2026-113003

A flaw was found in the Human Interface Device HID component of Chromium. A remote attacker could exploit this vulnerability by convincing a user to visit a specially crafted HTML page, triggering memory corruption. This issue allows the attacker to execute arbitrary code within the browser sandb...

CVE-2026-112999

A flaw was found in chromium-browser. A remote attacker can achieve arbitrary code execution inside the browser's sandbox environment by convincing a user to open a specially crafted HTML page. This issue stems from a use-after-free vulnerability in an application programming interface API, where...

CVE-2026-112992

A flaw was found in chromium-browser. A remote attacker could exploit a memory corruption vulnerability in the Canvas component by convincing a user to visit a specially crafted web page. Successful exploitation could allow the attacker to execute arbitrary code outside of the browser's security...

CVE-2026-113870

MongoDB Compass improperly escapes certain BSON values when converting a stored view’s aggregation pipeline into editable source. When a user connects to a MongoDB deployment containing a specially crafted view and opens that view for editing, the values can cause arbitrary code to execute with t...

ServiceNow-CVE-2025-11449-CVE-2025-11450-Mitigation-Script

ServiceNow CVE-2025-11449 & CVE-2025-11450 Mitigation Script Overview This script automatically detects and remediates CVE-2025-11449 and CVE-2025-11450 security vulnerabilities in ServiceNow UI Macros. These vulnerabilities could allow arbitrary code execution in users' browsers through speciall...

CVE-2026-113263

A flaw was found in chromium-browser. This flaw allows a remote attacker to achieve arbitrary code execution outside the browser sandbox by enticing a user to view a specially crafted HTML page. The vulnerability stems from a use-after-free memory error in the Core component, which occurs when...

CVE-2026-92183

A flaw was found in GIMP. This flaw allows an attacker to achieve arbitrary code execution by tricking a user into opening a specially crafted Animated Portable Network Graphics APNG image. The vulnerability is caused by a stack-based buffer overflow resulting from improper validation of data...

CVE-2026-94300

A flaw was found in BIND. This vulnerability may allow a remote attacker to achieve arbitrary code execution on the target server. An attacker who captures a valid User Datagram Protocol UDP message signed with Generic Security Service Transaction Signature GSS-TSIG can replay it while the...

bind: bind: Arbitrary code execution via GSS-TSIG UDP message replay

A flaw was found in BIND. This vulnerability may allow a remote attacker to achieve arbitrary code execution on the target server. An attacker who captures a valid User Datagram Protocol UDP message signed with Generic Security Service Transaction Signature GSS-TSIG can replay it while the...

cmd/go: golang: cmd/go: arbitrary code execution via untrusted module proxy

A flaw was found in the Go toolchain cmd/go. When a user works inside a malicious Go project that defines a bogus golang.org/fips140 module and connects to an untrusted Go module proxy GOMODPROXY, the proxy can serve an arbitrary replacement module that still passes local verification. This can...

CVE-2026-92209

NoMachine Redis Improper Authentication Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of NoMachine. An attacker must first obtain the ability to execute low-privileged code on the target system in order to...

CVE-2026-114125

Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, a malicious website can interact with the preview of a running Storybook development server. Insufficient iframe embedding and message-origi...

CVE-2026-113870 Improper Encoding of Server-Supplied JavaScript Values in MongoDB Compass BSON Parsing

MongoDB Compass improperly escapes certain BSON values when converting a stored view’s aggregation pipeline into editable source. When a user connects to a MongoDB deployment containing a specially crafted view and opens that view for editing, the values can cause arbitrary code to execute with t...

CVE-2026-113870

MongoDB Compass is vulnerable to arbitrary code execution due to improper escaping of certain BSON values when converting a stored view’s aggregation pipeline into an editable source. An attacker can trigger this by providing a specially crafted view within a MongoDB deployment. If a user connect...

EUVD-2026-107468

MongoDB Compass improperly escapes certain BSON values when converting a stored view’s aggregation pipeline into editable source. When a user connects to a MongoDB deployment containing a specially crafted view and opens that view for editing, the values can cause arbitrary code to execute with t...

CVE-2026-114113

A flaw was found in sharp. The library includes a bundled version of libvips affected by multiple vulnerabilities within its GIF, TIFF, and VIPS image decoders. An attacker can exploit this by supplying a specially crafted image file to an application processing untrusted input, which may lead to...

CVE-2026-114112

A flaw was found in sharp. An attacker can exploit this vulnerability by submitting specially crafted AV1 Image File Format AVIF or High-Efficiency Image File Format HEIF images to applications processing untrusted media. Due to memory corruption during image decoding in a bundled library,...

CVE-2026-114098

A flaw was found in Dulwich. This vulnerability allows an attacker to achieve arbitrary code execution by tricking a user into restoring a stash in a specially crafted Git repository. During a stash pop operation, intermediate directory symbolic links symlinks are followed without adequate...

CVE-2026-113300

A flaw was found in the Forms component of chromium-browser. This vulnerability allows a remote attacker to achieve arbitrary code execution outside of the browser security sandbox. By tricking a user into visiting a specially crafted HTML page, an attacker can trigger an out-of-bounds memory wri...