librsvg: Use-after-free when XML includes have duplicated entities

A flaw was found in librsvg. When processing an SVG document containing nested XML inclusions Xincludes with duplicate entity declarations, a use-after-free error can occur. This vulnerability arises because the library incorrectly frees an XML entity that is still in use by the parser. An attack...

CVE-2026-113259

A flaw was found in the Frames component of Chromium. A remote attacker can exploit this vulnerability by convincing a user to visit a specially crafted HTML page, triggering a use-after-free condition where memory is accessed after being released. Successful exploitation allows the attacker to...

CVE-2026-113255

A flaw was found in chromium-browser. A remote attacker could achieve arbitrary code execution within the browser's sandbox environment by convincing a user to open a specially crafted HTML page. This vulnerability is caused by a use-after-free memory error in the CustomTabs component...

CVE-2026-113227

A flaw was found in chromium-browser. This flaw allows a remote attacker to achieve arbitrary code execution within the browser sandbox due to a use-after-free issue in the Editing component, where previously released memory is improperly accessed. To exploit this vulnerability, an attacker must...

CVE-2026-113174

A flaw was found in the Extensions component of the Chromium browser. This vulnerability is caused by a use-after-free condition, which occurs when the application attempts to access memory after it has been released. A remote attacker could exploit this flaw by convincing a user to visit a...

CVE-2026-113123

A flaw was found in chromium-browser. A use-after-free flaw in the GPU Graphics Processing Unit component allows memory to be improperly accessed after it has been released. A remote attacker could exploit this vulnerability by enticing a user to visit a specially crafted HTML page, potentially...

CVE-2026-113156

A flaw was found in Google Chrome's Messages component. A remote attacker could execute arbitrary code within the browser sandbox by convincing a user to visit a specially crafted HTML page. This vulnerability is caused by a use-after-free error, where the application accesses memory that has...

CVE-2026-113112

A flaw was found in chromium-browser. A use-after-free vulnerability exists within the Extensions component. A remote attacker could exploit this flaw by enticing a user to view a specially crafted HTML page, potentially allowing arbitrary code execution within the browser's sandbox environment...

CVE-2026-113085

A flaw was found in the Media component of chromium-browser. By convincing a user to open a specially crafted HTML page, a remote attacker can trigger a use-after-free memory flaw, where the browser accesses memory after it has been released. Successful exploitation allows the attacker to execute...

CVE-2026-113044

A flaw was found in chromium-browser. This flaw allows a remote attacker to achieve arbitrary code execution within the browser's sandbox due to a use-after-free memory vulnerability in the V8 JavaScript engine. An attacker can exploit this issue by convincing a user to open a specially crafted...

CVE-2026-113087

A flaw was found in chromium-browser. The Actor component contains a use-after-free vulnerability, which occurs when memory is accessed after it has already been released. A remote attacker could exploit this issue by enticing a user to visit a specially crafted HTML page, potentially resulting i...

CVE-2026-113024

A flaw was found in chromium-browser. This vulnerability allows a remote attacker to achieve arbitrary code execution inside the sandbox environment by convincing a user to visit a specially crafted HTML page. The issue is caused by a use-after-free condition in the WebAppInstalls component, wher...

ALSA-2026:86907 Important: xorg-x11-server-Xwayland security update

Xwayland is an X server for running X clients under Wayland. Security Fixes: xorg-x11-server: xorg-x11-server: Arbitrary code execution via use-after-free in passive grab handling CVE-2026-93516 xorg-x11-server: xorg-x11-server: Privilege escalation via crafted RandR provider property requests...

PT-2026-120247

Deserialization of untrusted data in Mandiant FLARE floss releases before 3.2.0 allows arbitrary code execution when a crafted .viv or .exe.viv workspace is passed to the floss utility...

Linux Distros Unpatched Vulnerability : CVE-2026-113043

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in iOSWeb in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted...

PT-2026-120659

Lagoon is an application delivery platform for Kubernetes. Versions prior to 2.33.1 have a vulnerability in the ssh service in Lagoon core that would allow an attacker to execute arbitrary code which could lead to, among other things, elevated administrative permissions. It is mitigated by the fa...

PT-2026-120246

Deserialization of untrusted data in Mandiant FLARE capa releases before 10.0.0 allows arbitrary code execution when a crafted .viv or .exe.viv workspace is passed to the capa utility...

MiracleLinux 9 : emacs-27.2-18.el9_8.3 (AXSA:2026-2110:03)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-2110:03 advisory. emacs: Emacs: arbitrary code execution in Flymake mode CVE-2026-96442 Tenable has extracted the preceding description block directly from the MiracleLinux...

Rocky Linux 10.2 [CIQ] Security Update: emacs / emacs-common / emacs-common-debuginfo / emacs-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_84591)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202684591 advisory. emacs: GNU Emacs: Heap over-read leading to information disclosure via crafted image CVE-2026-77219 emacs: emacs: Command injection via crafted filenam...

Oracle Linux 9 : postgresql:18 (ELSA-2026-85814)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-85814 advisory. - Fixes CVE-2026-103484 out-of-bounds write during IVFFlat index build, which could lead to arbitrary code execution - Fix backport regression in...