PT-2026-132874

Use after free in Quota in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

PT-2026-133647

Paperclip 2026.403.0 before 2026.416.0 contains a remote code execution vulnerability that allows agent API key holders to set cleanupCommand and teardownCommand via PATCH /api/execution-workspaces/:id. When the workspace is archived, cleanupExecutionWorkspaceArtifacts runs these commands through...

CVE-2026-119706: InternLM lmdeploy: InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code execution vulnerability that allows…

InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code execution vulnerability that allows remote attackers to run OS commands by sending pickled data to the /updateweights endpoint. Attackers can submit a base64-encoded crafted pickle in serializednamedtensors, which...

CVE-2026-63345: christianhelle refitter: Refitter is a tool for generating a C# REST API client using the Refit library

Refitter is a tool for generating a C REST API client using the Refit library. Prior to 2.1.2, OpenAPI paths-object keys are emitted verbatim into Refit route attributes such as Get" " without escaping quotation marks or restricting characters. An attacker-influenced single-line, slash-prefixed...

CVE-2026-104067: Scribus: Scribus before 1.6.7 contains an out-of-bounds memory access vulnerability in the importsvm plugin that fails to verify…

Scribus before 1.6.7 contains an out-of-bounds memory access vulnerability in the importsvm plugin that fails to verify bitmap and transparency mask dimensions match. Attackers can supply a crafted SVM file with mismatched mask dimensions to trigger heap reads and writes, causing crashes or code...

CVE-2026-104066: Scribus: Scribus before 1.6.7 contains a heap buffer overflow vulnerability in the Mac PICT image loader and import plugin when…

Scribus before 1.6.7 contains a heap buffer overflow vulnerability in the Mac PICT image loader and import plugin when unpacking 4-bit indexed pixel data. Attackers can supply a crafted PICT file with inconsistent width and row data that, when placed or imported, writes out of bounds, causing...

PT-2026-132873

Memory corruption in Quota in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-61708: socfortress CoPilot: SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs

SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.76, POST /api/agentdatastore/upload in backend/app/datastore/datastoreroutes.py permits customeruser callers to choose bucketname and objectname without an allowlist, tenant prefix...

PT-2026-132877

Use after free in Blink in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-119116: AWS kmstool-enclave: A use-after-free and double-free issue in the SetClient command handler of the kmstool-enclave sample application of…

A use-after-free and double-free issue in the SetClient command handler of the kmstool-enclave sample application of AWS aws-nitro-enclaves-sdk-c before 0.4.6 may allow an application that runs on the parent EC2 instance to corrupt heap memory inside a Nitro Enclave which may lead to arbitrary co...

CVE-2026-37468

Cross Site Scripting vulnerability in BeeHome MyBeeHome before 2025-11-01 allows a remote attacker to execute arbitrary code via the Profile editing functionality, chat messaging component...

CVE-2026-119266: Google Chrome: Use after free in Quota in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute…

Use after free in Quota in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CentOS Linux 6 [TuxCare] Security Update: bind / bind-chroot / bind-devel / bind-libs / bind-sdb / bind-utils Multiple Vulnerabilities (CENTOS6:CLSA-2026:1793085399)

The CentOS Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS6:CLSA-2026:1793085399 advisory. - In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit...

PT-2026-133621

Scribus before 1.6.7 contains a heap buffer overflow vulnerability in the Mac PICT image loader and import plugin when unpacking 4-bit indexed pixel data. Attackers can supply a crafted PICT file with inconsistent width and row data that, when placed or imported, writes out of bounds, causing...

PT-2026-132875

Memory corruption in DOM in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-78403: Thalesgroup Sentinel Keys Server: Stack-based buffer overflow and missing authorization vulnerability in Thales Sentinel Keys Server on Windows allows…

Stack-based buffer overflow and missing authorization vulnerability in Thales Sentinel Keys Server on Windows allows Overflow Buffers. Sentinel Keys Server does not check the length of the first field in the HTTP request. An attacker may craft an HTTP request and send it to Sentinel Keys Server. ...

PT-2026-133613

A Deserialization of Untrusted Data vulnerability in the SubWorkflow task in Google Cloud Application Integration versions prior to 2026-09-11 on Google Cloud Platform allows an authenticated attacker to execute arbitrary code using a maliciously crafted serialized object. This vulnerability was...

CVE-2026-93327: Google Cloud Application Integration: A Deserialization of Untrusted Data vulnerability in the SubWorkflow task in Google Cloud Application Integration…

A Deserialization of Untrusted Data vulnerability in the SubWorkflow task in Google Cloud Application Integration versions prior to 2026-09-11 on Google Cloud Platform allows an authenticated attacker to execute arbitrary code using a maliciously crafted serialized object. This vulnerability was...

CVE-2026-119265: Google Chrome: Memory corruption in Quota in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute…

Memory corruption in Quota in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-63393: opensearch-project sql: OpenSearch SQL supports querying OpenSearch data using SQL and Piped Processing Language

OpenSearch SQL supports querying OpenSearch data using SQL and Piped Processing Language. In the 2.x line from 2.8.0.0 until 2.19.6.0, and the 3.x line prior to 3.7.0.0, a remote authenticated user with basic read/search permissions can provide a crafted cursor parameter to the plugins/sql endpoi...