X.Org Server GestureBuildSprite Use-After-Free Information Disclosure Vulnerability

This vulnerability allows local attackers to disclose sensitive information on affected installations of X.Org Server. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling...

SUSE CVE-2026-110807

A weakness has been identified in sgl-project SGLang up to 0.5.19. Affected by this vulnerability is an unknown functionality of the file python/sglang/srt/managers/iostruct.py of the component generate Endpoint. This manipulation of the argument sessionparams causes denial of service. The attack...

CVE-2026-92629

A potential improper authorization vulnerability was reported in Lenovo Baiying PC Client, distributed exclusively in the Chinese market, that could allow a local authenticated user to execute arbitrary code with elevated privileges...

DEBIAN-CVE-2026-110917

Memory corruption in SVG in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to read memory via a crafted HTML page. Chromium security severity: High...

CVE-2026-110917

Memory corruption in SVG in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to read memory via a crafted HTML page. Chromium security severity: High...

CVE-2026-110918

Memory corruption in Core in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to read memory via a crafted HTML page. Chromium security severity: High...

CVE-2026-110918

Memory corruption in Core in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to read memory via a crafted HTML page. Chromium security severity: High...

CVE-2026-110917

Memory corruption in SVG in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to read memory via a crafted HTML page. Chromium security severity: High...

CVE-2026-110918

A memory corruption vulnerability exists in the Core component of Google Chrome prior to version 155.0.8059.84 . A remote attacker can exploit this flaw by having a user visit a crafted HTML page , potentially allowing the attacker to read memory . This issue was addressed in the stable channel u...

CVE-2026-110917

Memory corruption in SVG in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to read memory via a crafted HTML page. Chromium security severity: High...

Improper Certificate Validation

Overview undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Improper Certificate Validation via the Agent constructor in lib/dispatcher/agent.js, where TLS options passed as the tls parameter are silently dropped and never stored ...

CVE-2026-111320

ValueCell versions through 0.1.20 are vulnerable to an unauthenticated server-side request forgery (SSRF) vulnerability. The root cause is the use of an unvalidated provider base_url that can be set via the provider configuration endpoint. Remote attackers can exploit this by triggering a POST /a...

wireshark: Wireshark: Denial of Service via C12.22 protocol dissector crash

A flaw was found in Wireshark. An unauthenticated remote attacker could exploit a vulnerability in the C12.22 protocol dissector by sending specially crafted network traffic. This could lead to a crash of the application, resulting in a Denial of Service DoS...

wireshark: Wireshark: Denial of Service vulnerability in H.245 protocol dissector

A flaw was found in Wireshark. A remote attacker could exploit a vulnerability in the H.245 protocol dissector. By crafting and sending malformed H.245 protocol data, an attacker could cause the Wireshark application to crash when a user processes this untrusted network data, leading to a denial ...

CVE-2026-108433

Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature locally...

CVE-2026-105034

The EnergizeLab Eilik NestJS auth service issues device tokens for arbitrary robot serial numbers without authentication. An unauthenticated remote attacker can obtain a valid device token for any serial number and act as that device against the cloud services...

CVE-2026-109468

A flaw was found in ASP.NET Core. The application framework fails to enforce limits or throttling on resource allocation when handling network requests. An unauthenticated remote attacker could exploit this vulnerability to exhaust system resources, leading to a Denial of Service DoS...

CVE-2026-63430

A flaw was found in ammonia. This vulnerability allows a remote attacker to conduct cross-site scripting XSS by submitting specially crafted markup to an application configured to permit specific Mathematical Markup Language MathML tags and raw-text elements. Because ammonia does not correctly...

CVE-2026-108443

An off-by-one error in Microsoft Office Word enables an unauthorized attacker to perform remote code execution over a network. The vulnerability has a CVSS 3.1 base score of 8.8 (High) , indicating high impact on confidentiality, integrity, and availability. While the CVSS metric suggests a low a...

CVE-2026-62322

A flaw was found in social-auth-core. The LINE authentication backend exchanges authorization codes without validating the returned Open Authorization OAuth state parameter. A remote attacker can exploit this flaw by enticing a victim into visiting a crafted callback URL, which can log the victim...